Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

A security policy requires that an application hosted on a Compute Engine virtual machine in Project-Analytics read log files stored in a Cloud Storage bucket located in Project-Logs. Following Google Cloud security best practices for access control, which setup should you implement?

  1. Create a user-managed service account in Project-Analytics, grant it the Storage Object Viewer role on the bucket in Project-Logs, and attach this service account to the VM instance.Answer
  2. B
    Create a service account in Project-Logs, export a JSON key file, and store the key file locally on the VM instance in Project-Analytics to authenticate API requests.
  3. C
    Grant the primitive Editor role to the default Compute Engine service account at the Project-Analytics level so permissions automatically inherit to Project-Logs.
  4. D
    Enable the Cloud Storage API in Project-Logs and rely on Project-Analytics default network firewall rules to allow access without IAM role assignments.

Answer

Create a user-managed service account in Project-Analytics, grant it the Storage Object Viewer role on the specific bucket in Project-Logs, and attach that service account to the Compute Engine VM.
Attaching a user-managed service account to a Compute Engine instance and granting that service account the predefined Storage Object Viewer role on the specific bucket in the destination project is the recommended, secure pattern for cross-project resource access inside GCP.

Step-by-Step Solution

1
Create a dedicated service account
A dedicated identity is established in the project where the compute resource resides (Project-Analytics).
Dedicated user-managed service accounts allow fine-grained permission assignment tailored specifically to the workload.
2
Bind the minimal required IAM role on the target resource
The service account gains read-only access (`roles/storage.objectViewer`) strictly for the bucket located in Project-Logs.
Granting resource-level permissions follows Google Cloud security best practices for cross-project access.
3
Attach the service account to the VM instance
Application Default Credentials (ADC) on the VM automatically fetch short-lived tokens from the metadata server.
This avoids generating or managing long-lived service account key files.

Key Concept

Cross-Project Service Account Management and Least Privilege
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic