Question

Difficulty: HardDeploying and Managing Compute Engine Virtual Machines

A cloud engineer must provision a Compute Engine virtual machine instance that automatically retrieves and executes a startup script stored in a private Cloud Storage bucket (`gs://corp-scripts-prod/init.sh`). The environment mandates strict adherence to the principle of least privilege using custom identities. Arrange the operational steps in the correct sequential order to properly configure permissions, deploy the VM instance via `gcloud`, and validate deployment success.

  1. 1Create a dedicated custom service account using `gcloud iam service-accounts create`.
  2. 2Grant the custom service account the `roles/storage.objectViewer` role on the Cloud Storage bucket `gs://corp-scripts-prod`.
  3. 3Run `gcloud compute instances create` specifying `--service-account` with the custom identity email and `--metadata=startup-script-url=gs://corp-scripts-prod/init.sh`.
  4. 4Execute `gcloud compute instances get-serial-port-output` to inspect boot logs and verify that the startup script finished execution.

Answer

The correct sequence is: 1) Create the dedicated custom service account, 2) Grant the Storage Object Viewer role to the service account on the Cloud Storage bucket, 3) Run `gcloud compute instances create` referencing the custom service account and setting `startup-script-url`, and 4) Execute `gcloud compute instances get-serial-port-output` to verify script execution.
Proper deployment order requires establishing the service account identity first, authorizing that identity to read the target Cloud Storage object second, deploying the instance with the appropriate gcloud flags pointing to the identity and script metadata third, and finally querying the serial port output to confirm successful script execution.

Step-by-Step Solution

1
Create a dedicated custom service account for the VM workload.
A specific service account identity is established in IAM.
Least privilege mandates avoiding default service accounts with broad primitive roles.
2
Assign the `roles/storage.objectViewer` role to the custom service account for the bucket containing the script.
The identity gains read access to objects inside `gs://corp-scripts-prod`.
Compute Engine startup script fetching uses the VM instance's attached service account credentials.
3
Provision the instance with `gcloud compute instances create` using `--service-account` and `--metadata=startup-script-url=...`.
The instance launches, binds the service account, and fetches the startup script on first boot.
Flags must specify both identity bindings and startup script location.
4
Inspect serial port output logs using `gcloud compute instances get-serial-port-output`.
The engineer confirms that `startup-script` completed without exit code failures.
Serial output provides runtime confirmation of startup script execution on Linux Compute Engine images.

Key Concept

Deploying Compute Engine VMs with custom service accounts and GCS startup scripts
Rate this question