Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

A cloud engineer needs to configure a running Compute Engine VM instance to securely read objects from a Cloud Storage bucket using a dedicated user-managed service account following Google Cloud security best practices. In what order should the engineer execute the following steps to complete this configuration using `gcloud` CLI tools?

  1. 1Create a dedicated user-managed service account named `app-processor-sa` in the project using `gcloud iam service-accounts create`.
  2. 2Grant the `roles/storage.objectViewer` role to `app-processor-sa` on the target Cloud Storage bucket using `gcloud storage buckets add-iam-policy-binding`.
  3. 3Stop the running Compute Engine VM instance using `gcloud compute instances stop`.
  4. 4Attach `app-processor-sa` to the VM instance using `gcloud compute instances set-service-account` with the `cloud-platform` scope.
  5. 5Start the Compute Engine VM instance using `gcloud compute instances start`.

Answer

The correct order of steps is: 1) Create the user-managed service account, 2) Grant the required IAM storage role on the bucket, 3) Stop the Compute Engine instance, 4) Attach the service account with the cloud-platform scope, and 5) Start the instance.
The proper sequence begins by provisioning the identity via IAM service-accounts create, binding the least-privilege predefined storage role to the bucket, stopping the VM instance, applying the new service account identity with full API access scopes using gcloud compute instances set-service-account, and finally starting the instance to enable metadata server token retrieval.

Step-by-Step Solution

1
Provision the service account identity
The service account `app-processor-sa` is created in IAM.
An identity must exist in IAM before permissions can be granted or attached to compute workloads.
2
Bind least privilege IAM roles to the service account
The service account gains read access specifically to objects within the target bucket.
Granting resource-level predefined roles ensures access control compliance prior to workload launch.
3
Stop the target Compute Engine instance
The VM instance transitions to the `TERMINATED` state.
Compute Engine service account association updates require the VM instance to be stopped.
4
Update VM configuration to assign the service account
The VM instance is configured with `app-processor-sa` and the `cloud-platform` access scope.
This configures the instance metadata server identity binding without embedding static keys.
5
Start the VM instance
The VM is running with the new service account identity.
Workloads running on the VM can now automatically query the metadata server for short-lived OAuth access tokens.

Key Concept

Creating and Attaching User-Managed Service Accounts to Compute Instances
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic