An organization is deploying a Compute Engine virtual machine instance named `data-worker` to process batch analytics. The application running inside `data-worker` must read files from a Cloud Storage bucket using a custom service account named `[email protected]`. To follow Google Cloud security best practices, the custom service account has been granted only the Storage Object Viewer IAM role on the bucket. Which `gcloud compute instances create` command correctly attaches the custom service account while allowing IAM roles to govern the instance's access?
- gcloud compute instances create data-worker --service-account=processing-sa@prod-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platformAnswer
- Bgcloud compute instances create data-worker [email protected]
- Cgcloud compute instances create data-worker --provisioning-model=SPOT --instance-termination-action=DELETE
- Dgcloud compute instances create data-worker --service-account=default --scopes=roles/owner
Answer
Execute gcloud compute instances create data-worker --service-account=processing-sa@prod-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform
When creating a Compute Engine VM with a custom service account, Google Cloud best practice requires attaching the service account via the --service-account flag and setting the scope to https://www.googleapis.com/auth/cloud-platform. This allows IAM permissions granted to that service account to serve as the effective boundary for Google Cloud API requests.
Step-by-Step Solution
Key Concept
Attaching custom service accounts and configuring access scopes during Compute Engine VM deployment