A system administrator needs to deploy a new Compute Engine virtual machine instance named `analytics-node-1` in zone `us-central1-a` using the `gcloud` CLI. The instance must run using a custom service account named `[email protected]`. To adhere to Google Cloud security best practices, access control should be strictly managed by the IAM roles assigned to the service account rather than restricted by access scopes. Which `gcloud compute instances create` command correctly configures the instance with these access settings?
- gcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platformAnswer
- Bgcloud compute instances create analytics-node-1 --zone=us-central1-a [email protected]
- Cgcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --preemptible
- Dgcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --role=roles/owner
Answer
The command that uses --service-account=analytics-sa@my-project.iam.gserviceaccount.com along with --scopes=https://www.googleapis.com/auth/cloud-platform correctly attaches the custom service account while allowing IAM roles to control API access permissions.
The correct approach attaches the custom service account via the `--service-account` flag and grants it the `cloud-platform` access scope via `--scopes`. This ensures that GCP API access limits are not artificially restricted by legacy scopes, allowing the IAM roles assigned to the service account to determine exact permissions.
Step-by-Step Solution
Key Concept
Attaching Service Accounts and Scopes to Compute Engine Instances