Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

An enterprise media processing team is setting up an automated Deployment Manager pipeline to provision a fleet of Compute Engine instances managed by a regional Managed Instance Group (MIG). The deployment pipeline runs under a dedicated deployment service account `[email protected]`. The Compute Engine instances must run under a separate application runtime service account `[email protected]`. During the initial pipeline run, instance template creation fails with an IAM permission error when attempting to attach `app-runner` to the VM template. Which IAM configuration resolves the deployment failure while adhering to the principle of least privilege?

  1. Grant the Service Account User role (roles/iam.serviceAccountUser) on the app-runner service account to the deploy-sa service account.Answer
  2. B
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level to the deploy-sa service account.
  3. C
    Grant the Owner primitive role (roles/owner) on the app-runner service account to the deploy-sa service account.
  4. D
    Submit a regional quota increase request for Compute Engine API service account attachments before executing the deployment pipeline.

Answer

Granting the Service Account User role (`roles/iam.serviceAccountUser`) on the `app-runner` service account to the `deploy-sa` deployment service account allows the deployment pipeline to attach `app-runner` to Compute Engine instances under the principle of least privilege.
To attach a service account to a Compute Engine instance template or VM, the identity running the provisioning job must have the `iam.serviceAccounts.actAs` permission on the target service account. The predefined role `roles/iam.serviceAccountUser` grants this permission. Applying this role at the resource level on the target service account enforces least privilege.

Step-by-Step Solution

1
Identify the cause of the provisioning failure
The deployment pipeline service account (`deploy-sa`) requires permission to impersonate or bind the runtime service account (`app-runner`) to the compute resources being created.
Compute Engine instance creation requires the acting entity to possess authority to attach the target service account to the virtual machine.
2
Evaluate required IAM roles against the least privilege principle
The `roles/iam.serviceAccountUser` role grants permission to act on behalf of the service account without allowing administrative modifications to IAM policies or key management.
Predefined granular roles prevent over-provisioning security access during automated deployments.
3
Select resource-level binding target
Binding `roles/iam.serviceAccountUser` specifically on the `app-runner` resource (rather than project-wide) limits scope to only the intended runtime identity.
Resource-level IAM bindings restrict access exclusively to the specific identity needed by the deployment pipeline.

Key Concept

Compute Engine Service Account Impersonation and Attachment Permissions
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic