A platform engineering team is setting up a new Google Cloud project named `customer-insights-prod`. An automated deployment pipeline using a dedicated service account must enable the Cloud Pub/Sub API (`pubsub.googleapis.com`) and the Cloud SQL Admin API (`sqladmin.googleapis.com`) within this target project. Which of the following actions must be taken to ensure the APIs are enabled successfully using the principle of least privilege? (Select TWO.)
- Grant the deployment service account the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on the `customer-insights-prod` project.Answer
- Execute `gcloud services enable pubsub.googleapis.com sqladmin.googleapis.com --project=customer-insights-prod` in the CLI environment.Answer
- CGrant the deployment service account the Service Usage Consumer role (`roles/serviceusage.serviceUsageConsumer`) on the parent Organization node.
- DExecute `gcloud services enable pubsub.googleapis.com sqladmin.googleapis.com` while authenticated to the organization root without specifying a project parameter.
Answer
Granting the deployment service account the Service Usage Admin role on the target project and executing the gcloud command with the --project flag enables the required APIs with appropriate permissions.
To enable Google Cloud APIs, an identity requires the `serviceusage.services.enable` permission provided by `roles/serviceusage.serviceUsageAdmin` on the target project. Furthermore, APIs must be enabled at the project level by executing `gcloud services enable` with the full service names and the `--project` flag specified.
Step-by-Step Solution
Key Concept
Enabling Cloud Service APIs via IAM and gcloud CLI
Estimated Time:1m 30s