Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

A cloud administrator needs to replace the default Compute Engine service account on an existing virtual machine with a newly created custom user-managed service account. The application running on the instance requires read-only access to objects inside a specific Google Cloud Storage bucket. Following Google Cloud security best practices, in what correct sequential order should the administrator perform the steps to configure and attach the identity?

  1. 1Create the custom user-managed service account in the project using gcloud iam service-accounts create.
  2. 2Grant the roles/storage.objectViewer role to the service account on the target Cloud Storage bucket.
  3. 3Grant the deployment administrator the roles/iam.serviceAccountUser role on the custom service account.
  4. 4Stop the virtual machine and execute gcloud compute instances set-service-account to attach the custom service account.

Answer

The correct operational sequence is: 1) Create the custom user-managed service account, 2) Grant the roles/storage.objectViewer role to the service account on the target bucket, 3) Grant the roles/iam.serviceAccountUser role to the administrator on the service account, and 4) Stop the instance and update its service account assignment using gcloud compute instances set-service-account.
The correct logical sequence follows dependency order in GCP identity management: first create the identity, second define what resources the identity can access (bucket-level Object Viewer), third grant the deploying user permission to use the identity (roles/iam.serviceAccountUser), and finally update the workload configuration to bind the identity to the Compute Engine virtual machine.

Step-by-Step Solution

1
Provision the new service account resource using gcloud CLI.
Generates a unique service account email address (e.g., [email protected]).
An identity must exist before permissions can be bound or assigned.
2
Bind the granular IAM role roles/storage.objectViewer to the service account email on the specific bucket.
Configures resource-level permissions following the principle of least privilege.
Configuring resource permissions before attaching identity prevents permission gap windows upon workload startup.
3
Assign roles/iam.serviceAccountUser on the service account to the identity performing the VM update.
Authorizes the administrator to attach the service account to compute workloads.
Without the Service Account User role, Compute Engine prevents users from attaching service accounts to instances.
4
Stop the Compute Engine instance and reassign its identity with gcloud compute instances set-service-account.
The VM replaces its default service account identity with the custom user-managed service account.
Changing a running VM's service account requires stopping the instance or using the set-service-account command with appropriate flags.

Key Concept

Lifecycle and delegation pattern for user-managed service account creation, IAM role assignment, and Compute Engine attachment.
Estimated Time:2m 0s
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic