A cloud engineering team is deploying an automated data ingestion workload on Compute Engine virtual machine instances in a staging project. The workload must read source files from Google Cloud Storage buckets located in a separate production analytics project. Following Google Cloud security best practices for managing service accounts and IAM access, which two configuration steps should the team perform? (Select TWO.)
- Create a user-managed service account in the staging project and attach it to the Compute Engine VM instances.Answer
- Grant the service account the predefined Storage Object Viewer role on the specific Cloud Storage buckets in the production project.Answer
- CGenerate a service account JSON key file and upload it to the Compute Engine VM disk to authenticate Cloud Storage API calls.
- DGrant the service account the primitive Editor role at the project level across both staging and production projects.
- EAssign the Storage Admin role to the service account at the organization level, expecting resource-level restrictions in child projects to restrict access.
Answer
The correct steps are to create a user-managed service account in the staging project, attach it to the Compute Engine VM instances, and grant that service account the predefined Storage Object Viewer role directly on the production Cloud Storage buckets.
The correct configuration requires creating a dedicated user-managed service account in the staging project housing the Compute Engine VMs and attaching it directly to the instances. Access to the external production Cloud Storage buckets is provided by granting the service account the specific predefined Storage Object Viewer role on those buckets, ensuring least privilege and secure credential management via instance metadata.
Step-by-Step Solution
Key Concept
Best practices for creating user-managed service accounts, attaching them to Compute Engine workloads, and configuring cross-project IAM access using least privilege without service account keys.