Examkin

Question

Difficulty: HardDeploying and Managing Compute Engine Virtual Machines

A cloud engineer needs to deploy a Compute Engine virtual machine instance that automatically executes an initialization script stored in a private Google Cloud Storage bucket upon booting. What is the correct sequence of steps to configure access, provision the VM instance, and verify deployment execution?

  1. 1Upload the initialization script `startup.sh` to the designated Cloud Storage bucket `gs://prod-init-scripts-bucket/`.
  2. 2Grant the Storage Object Viewer role (`roles/storage.objectViewer`) on `gs://prod-init-scripts-bucket/` to the custom service account `[email protected]`.
  3. 3Execute `gcloud compute instances create app-vm` specifying `[email protected]`, `--scopes=cloud-platform`, and `--metadata=startup-script-url=gs://prod-init-scripts-bucket/startup.sh`.
  4. 4Run `gcloud compute instances get-serial-port-output app-vm` to inspect console logs and confirm successful script execution.

Answer

The correct sequence begins by uploading the bash initialization script to the target Cloud Storage bucket, followed by granting the Storage Object Viewer IAM role to the VM's custom service account on that bucket. Next, the VM instance is created using gcloud with the attached service account, cloud-platform scope, and startup-script-url metadata key. Finally, serial port output logs are retrieved using gcloud to verify script completion.
To successfully deploy a VM configured with a startup script located in Cloud Storage, the file must first exist in the bucket. Second, the custom service account assigned to the VM must be granted `roles/storage.objectViewer` on that bucket so the boot agent can read the file. Third, running `gcloud compute instances create` with `--service-account`, `--scopes=cloud-platform`, and `--metadata=startup-script-url` provisions the VM and initiates execution. Fourth, running `gcloud compute instances get-serial-port-output` provides verification that the initialization script executed properly.

Step-by-Step Solution

1
Upload the script artifact to Google Cloud Storage.
The file `startup.sh` is stored at `gs://prod-init-scripts-bucket/startup.sh`.
The startup script resource must be uploaded to Cloud Storage before it can be referenced in metadata.
2
Configure IAM access permissions on the bucket.
Service account `[email protected]` receives `roles/storage.objectViewer`.
Applying least-privilege IAM roles ensures the VM identity is authorized to access the private bucket when fetching the script.
3
Provision the Compute Engine VM via gcloud CLI.
Instance `app-vm` starts up with custom identity and startup script metadata.
Combining `--service-account`, `--scopes=cloud-platform`, and `--metadata=startup-script-url` allows the instance startup agent to retrieve and execute the script at boot.
4
Inspect serial port output logs.
Console output confirms the initialization script finished without errors.
Retrieving serial port output is the standard method for validating startup script execution status post-deployment.

Key Concept

Provisioning Compute Engine VMs with GCS-based Startup Scripts and Custom Service Accounts
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic