Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

An organization hosts a data-processing workload on a Compute Engine virtual machine instance located in GCP Project `proj-analytics`. The application requires read-only access to a Cloud Storage bucket situated in a separate project named `proj-data-warehouse`. According to Google Cloud security best practices for creating and managing service accounts, which of the following actions should the administrator perform to enable cross-project authorization securely? (Select TWO correct answers.)

  1. Create a user-managed service account in `proj-analytics` and attach it to the Compute Engine VM instance upon creation.Answer
  2. Grant the user-managed service account principal from `proj-analytics` the Storage Object Viewer (`roles/storage.objectViewer`) role on the specific Cloud Storage bucket in `proj-data-warehouse`.Answer
  3. C
    Generate a static JSON service account key for a service account created in `proj-data-warehouse` and store the key file locally on the Compute Engine VM disk.
  4. D
    Assign the primitive Editor (`roles/editor`) role to the compute instance's service account at the `proj-data-warehouse` project level.
  5. E
    Enable the Google Cloud APIs in `proj-data-warehouse` only, assuming cross-project service account access bypasses API enablement in `proj-analytics`.

Answer

To establish secure cross-project authorization, the administrator must create a dedicated user-managed service account in the source project hosting the Compute Engine instance and grant that service account's email address the predefined Storage Object Viewer role on the bucket in the destination project.
Secure cross-project access in Google Cloud relies on creating a custom user-managed service account within the source project where the compute resource resides, attaching that service account to the VM instance, and granting its email address a minimal predefined role (such as Storage Object Viewer) directly on the target resource in the remote project.

Step-by-Step Solution

1
Provision a user-managed service account in the source project (`proj-analytics`).
A dedicated service account identity is established for the workload rather than relying on default service accounts.
User-managed service accounts allow fine-grained access control tailored to specific application requirements.
2
Attach the custom service account to the Compute Engine VM instance.
Application API calls from the VM automatically retrieve application default credentials (ADC) for identity assertion.
Attaching the service account directly eliminates the need to manage static JSON security keys on local disk.
3
Grant the service account email the Storage Object Viewer role on the destination bucket in `proj-data-warehouse`.
The identity in the source project is authorized to read objects in the destination bucket.
IAM roles can be assigned to cross-project service account principals using their full email identity.

Key Concept

Cross-Project Service Account Access and Principle of Least Privilege
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic