Question

Difficulty: Very hardCreating and Managing Service Accounts

Your enterprise security policy strictly forbids downloading exportable service account keys. You are tasked with provisioning a Compute Engine virtual machine instance in `prod-app-project` that requires read access to a BigQuery dataset located in `prod-analytics-project`. Arrange the administrative actions in the correct chronological sequence to configure and attach a custom service account under least-privilege best practices.

  1. 1Create a dedicated custom service account inside `prod-app-project`.
  2. 2Grant the `roles/bigquery.dataViewer` role to the custom service account on the specific dataset in `prod-analytics-project`.
  3. 3Grant the `roles/iam.serviceAccountUser` role on the custom service account to the VM deployment principal in `prod-app-project`.
  4. 4Provision the Compute Engine VM instance in `prod-app-project` configured with the newly created custom service account identity.

Answer

The correct operational sequence begins by creating the custom service account in the source project, granting cross-project dataset access to that identity, assigning the Service Account User role to the provisioning principal, and finally attaching the service account during VM creation.
Establishing a keyless cross-project workload identity requires sequential execution: creating the service account identity in the home project, granting the service account resource-level access in the destination project, delegating Service Account User permissions to the deployment principal, and finally binding the service account to the Compute Engine instance.

Step-by-Step Solution

1
Create the service account in the local project using gcloud IAM service-accounts create.
A unique service account identity (email ID) is established in `prod-app-project`.
You cannot grant roles or delegate attachment privileges to an identity before creating it.
2
Bind the target dataset access role in the remote project to the new service account email.
The service account gains granular permission (`roles/bigquery.dataViewer`) on the resource in `prod-analytics-project`.
Configuring access prior to workload deployment ensures immediate operational readiness upon instance startup.
3
Grant `roles/iam.serviceAccountUser` on the service account to the deploying user or pipeline identity.
The deployment principal receives explicit permission to impersonate/attach the service account to Compute Engine resources.
Without `roles/iam.serviceAccountUser`, Compute Engine instance creation specifying this service account will be blocked by IAM authorization checks.
4
Deploy the Compute Engine instance specifying the `--service-account` flag in `prod-app-project`.
The virtual machine runs under the credentials of the dedicated custom service account keylessly via metadata server integration.
Attaching the service account at instance creation ensures keyless identity metadata propagation to the workload.

Key Concept

Cross-Project Service Account Management and Compute Engine IAM Attachment
Rate this question