Your enterprise security policy strictly forbids downloading exportable service account keys. You are tasked with provisioning a Compute Engine virtual machine instance in `prod-app-project` that requires read access to a BigQuery dataset located in `prod-analytics-project`. Arrange the administrative actions in the correct chronological sequence to configure and attach a custom service account under least-privilege best practices.
- 1Create a dedicated custom service account inside `prod-app-project`.
- 2Grant the `roles/bigquery.dataViewer` role to the custom service account on the specific dataset in `prod-analytics-project`.
- 3Grant the `roles/iam.serviceAccountUser` role on the custom service account to the VM deployment principal in `prod-app-project`.
- 4Provision the Compute Engine VM instance in `prod-app-project` configured with the newly created custom service account identity.
Answer
The correct operational sequence begins by creating the custom service account in the source project, granting cross-project dataset access to that identity, assigning the Service Account User role to the provisioning principal, and finally attaching the service account during VM creation.
Establishing a keyless cross-project workload identity requires sequential execution: creating the service account identity in the home project, granting the service account resource-level access in the destination project, delegating Service Account User permissions to the deployment principal, and finally binding the service account to the Compute Engine instance.
Step-by-Step Solution
Key Concept
Cross-Project Service Account Management and Compute Engine IAM Attachment