Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

A financial technology enterprise is automating the deployment of a high-throughput transaction processing engine on Google Cloud using an automated delivery pipeline. The CI/CD pipeline executes using a dedicated deployment service account that provisions a Compute Engine Managed Instance Group (MIG). The VMs in the instance template are configured to run under a separate application runtime service account with fine-grained database access permissions. During pipeline deployment, Compute Engine returns an authorization failure indicating that the deployment service account is not allowed to attach the runtime service account to the newly provisioned instances. Which action should the cloud architect take to resolve this failure while adhering to the principle of least privilege?

  1. Grant the deployment service account the Service Account User role (roles/iam.serviceAccountUser) specifically on the application runtime service account.Answer
  2. B
    Grant the deployment service account the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level.
  3. C
    Grant the deployment service account the primitive Editor role (roles/editor) at the project level.
  4. D
    Reconfigure the pipeline to provision a GKE Private Cluster with Control Plane Authorized Networks instead of Compute Engine VMs.

Answer

Grant the deployment service account the Service Account User role (roles/iam.serviceAccountUser) specifically on the application runtime service account.
To attach a service account to a Compute Engine instance template or VM, the deploying identity needs permission to act as that service account. Granting the Service Account User role (`roles/iam.serviceAccountUser`) directly on the runtime service account fulfills this requirement securely without granting project-wide elevated rights.

Step-by-Step Solution

1
Identify the missing IAM permission required for compute provisioning.
Compute Engine requires the identity creating the instances to hold `iam.serviceAccounts.actAs` permission on the target runtime service account.
When creating resources that run as a specific service account, GCP enforces security checks so users cannot elevate privileges illegally.
2
Apply the least-privilege IAM role to the specific target resource.
Granting `roles/iam.serviceAccountUser` specifically on the runtime service account resource gives the deployment service account exactly the required privilege.
Resource-level role bindings prevent over-granting permissions across all service accounts or project-level resources.

Key Concept

Compute Engine Service Account Impersonation and IAM Service Account User Role
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic