Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

A security audit highlights that a Compute Engine virtual machine running an automated nightly report generator is using the default Compute Engine service account with the primitive Editor role. To comply with security mandates and the principle of least privilege, you need to reconfigure the workload to use a dedicated user-managed service account that only has access to read Cloud Storage objects and write BigQuery datasets in the project. Which sequence of steps should you take?

  1. A
    Create a user-managed service account, grant it the broad Editor role at the project level, generate a new JSON service account key file, and save the key file inside the Virtual Machine filesystem.
  2. B
    Create a user-managed service account, grant it the roles/storage.objectViewer and roles/bigquery.dataEditor predefined roles on the project, download its JSON key file, and pass the key to the application using environment variables.
  3. Create a user-managed service account, grant it the roles/storage.objectViewer and roles/bigquery.dataEditor roles at the project level, stop the VM instance, attach the new service account to the VM, and restart the instance.Answer
  4. D
    Edit the existing default Compute Engine service account policy at the instance level to deny all permissions except Cloud Storage and BigQuery, leaving the project-level Editor role intact.

Answer

Create a dedicated user-managed service account, grant it the predefined roles roles/storage.objectViewer and roles/bigquery.dataEditor at the project level, stop the VM instance, attach the custom service account to the VM, and restart the instance.
The solution follows Google Cloud security best practices by replacing the default service account with a custom user-managed service account, granting minimal predefined roles (roles/storage.objectViewer and roles/bigquery.dataEditor), and attaching the service account directly to the Compute Engine instance so the application uses automatic metadata credentials rather than exported long-lived JSON key files.

Step-by-Step Solution

1
Create a dedicated user-managed service account
A new service account identity is established specifically for the reporting workload.
Default service accounts should not be used for production workloads as they often default to overly permissive broad roles.
2
Bind predefined IAM roles to the service account at the project level
The service account gains roles/storage.objectViewer and roles/bigquery.dataEditor permissions.
Predefined roles satisfy the principle of least privilege by providing only the required Cloud Storage read and BigQuery dataset write capabilities.
3
Attach the user-managed service account to the VM instance without generating exportable keys
The VM automatically acquires credentials from the instance metadata service.
Attaching the service account directly eliminates the storage and management risks associated with long-lived JSON service account keys.

Key Concept

User-managed service accounts best practices and VM attachment
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic