Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

A cloud engineer needs to configure access for an application running on a Compute Engine VM in project `prod-app-project`. The application must publish messages to a Cloud Pub/Sub topic in the same project. Following Google Cloud security best practices, access must follow the principle of least privilege without generating long-lived service account keys. Which set of `gcloud` commands correctly creates the service account and grants the minimum required access?

  1. Execute `gcloud iam service-accounts create app-runner-sa --display-name="App Runner SA"` and then run `gcloud projects add-iam-policy-binding prod-app-project --member="serviceAccount:[email protected]" --role="roles/pubsub.publisher"`.Answer
  2. B
    Execute `gcloud iam service-accounts create app-runner-sa --display-name="App Runner SA"` and then run `gcloud projects add-iam-policy-binding prod-app-project --member="serviceAccount:[email protected]" --role="roles/editor"`.
  3. C
    Execute `gcloud iam service-accounts create app-runner-sa --display-name="App Runner SA"` and then run `gcloud iam service-accounts keys create key.json --iam-account=app-runner-sa@prod-app-project.iam.gserviceaccount.com` to download and attach service account credentials to the VM.
  4. D
    Execute `gcloud organizations add-iam-policy-binding MY_ORG_ID --member="serviceAccount:[email protected]" --role="roles/pubsub.admin"` to ensure cross-resource inheritance.

Answer

Create the custom service account using `gcloud iam service-accounts create` and grant the specific predefined role `roles/pubsub.publisher` using `gcloud projects add-iam-policy-binding`.
Creating a dedicated service account and binding the `roles/pubsub.publisher` predefined role directly at the project level complies with security mandates by adhering to the principle of least privilege. Furthermore, attaching this service account directly to the VM eliminates the security risks associated with exported service account key files.

Step-by-Step Solution

1
Identify the proper IAM identity strategy
Use a dedicated user-managed service account attached to the Compute Engine instance instead of default service accounts or static JSON keys.
Attaching a custom service account avoids managing security keys manually and adheres to GCP identity recommendations.
2
Select the least-privilege predefined IAM role
`roles/pubsub.publisher` grants permissions to publish messages to Cloud Pub/Sub topics.
Primitive roles like Editor or overly broad administrative roles like Pub/Sub Admin grant unnecessary permissions.
3
Formulate the exact `gcloud` CLI commands
`gcloud iam service-accounts create` creates the account, and `gcloud projects add-iam-policy-binding` binds the IAM role to the service account member.
This establishes the identity and enforces resource permissions at the appropriate project scope.

Key Concept

Creating User-Managed Service Accounts and Assigning Predefined Least-Privilege Roles via gcloud
Estimated Time:1m 30s
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic