A cloud administrator is preparing to provision compute resources for a stateless web application using Compute Engine Managed Instance Groups (MIGs) via an automated deployment pipeline. Which TWO steps should the administrator take to ensure correct IAM privilege bounds and avoid provisioning failure during initial deployment? (Select TWO)
- Request a regional Compute Engine CPU quota increase in advance if forecasted autoscaling peak capacity exceeds default project quotas.Answer
- Grant the deployment service account the Service Account User role on the instance runtime service account.Answer
- CGrant the deployment service account the primitive Project Owner role to ensure unrestricted resource creation across compute services.
- DStore the deployment Infrastructure as Code (IaC) state file on local developer workstations to simplify state tracking.
- EProvision a multi-zone GKE cluster with specialized node pools to run the simple stateless application binary.
Answer
The correct steps are requesting a regional CPU quota increase in advance if expected peak capacity exceeds limits, and granting the deployment service account the Service Account User role on the runtime service account.
Requesting quota increases in advance ensures compute instances can scale out to required capacity without failing due to regional limits. Additionally, granting the Service Account User role (`roles/iam.serviceAccountUser`) allows the deployment service account to attach the designated runtime service account to VM instances securely without requiring over-privileged administrative access.
Step-by-Step Solution
Key Concept
Provisioning Compute Engine resources requires proactive regional quota management and fine-grained IAM configuration using minimal necessary role grants.