A cloud engineer must provision a Compute Engine virtual machine instance that automatically retrieves and executes a startup script stored in a private Cloud Storage bucket (`gs://corp-scripts-prod/init.sh`). The environment mandates strict adherence to the principle of least privilege using custom identities. Arrange the operational steps in the correct sequential order to properly configure permissions, deploy the VM instance via `gcloud`, and validate deployment success.
- 1Create a dedicated custom service account using `gcloud iam service-accounts create`.
- 2Grant the custom service account the `roles/storage.objectViewer` role on the Cloud Storage bucket `gs://corp-scripts-prod`.
- 3Run `gcloud compute instances create` specifying `--service-account` with the custom identity email and `--metadata=startup-script-url=gs://corp-scripts-prod/init.sh`.
- 4Execute `gcloud compute instances get-serial-port-output` to inspect boot logs and verify that the startup script finished execution.
Answer
The correct sequence is: 1) Create the dedicated custom service account, 2) Grant the Storage Object Viewer role to the service account on the Cloud Storage bucket, 3) Run `gcloud compute instances create` referencing the custom service account and setting `startup-script-url`, and 4) Execute `gcloud compute instances get-serial-port-output` to verify script execution.
Proper deployment order requires establishing the service account identity first, authorizing that identity to read the target Cloud Storage object second, deploying the instance with the appropriate gcloud flags pointing to the identity and script metadata third, and finally querying the serial port output to confirm successful script execution.
Step-by-Step Solution
Key Concept
Deploying Compute Engine VMs with custom service accounts and GCS startup scripts