A cloud engineer must deploy a Compute Engine virtual machine instance that automatically executes a startup script to read files from a secure Cloud Storage bucket. To ensure least-privilege security, the VM must authenticate using a dedicated custom service account rather than the default Compute Engine service account. Place the operational steps in the correct chronological order required to set up and deploy this VM instance.
- 1Create a new custom IAM service account within the Google Cloud project.
- 2Grant the Storage Object Viewer IAM role to the custom service account on the target Cloud Storage bucket.
- 3Execute the `gcloud compute instances create` command, specifying the `--service-account` flag and setting `--metadata-from-file=startup-script=...`.
- 4Verify VM startup and confirm successful file access via Cloud Logging and instance application logs.
Answer
The correct operational order is: 1) Create the custom IAM service account, 2) Grant the Storage Object Viewer IAM role to the service account, 3) Execute the gcloud compute instances create command with the service account and startup script metadata flags, and 4) Verify VM startup and inspect logs.
Proper GCP infrastructure deployment dictates creating identity resources (service accounts) first, granting them specific role permissions second, instantiating compute resources with those identities and metadata scripts third, and verifying log execution fourth.
Step-by-Step Solution
Key Concept
Compute Engine Service Account Provisioning & Startup Configuration