Examkin

Question

Difficulty: EasySecrets Management and Service Account Lifecycle Security

An organization is deploying an application on a Compute Engine virtual machine instance that needs read-only access to objects stored in a Cloud Storage bucket. Which configuration aligns with Google Cloud recommended best practices for service account security and least privilege?

  1. Create a user-managed service account with the Storage Object Viewer role assigned to it, and attach this service account to the Compute Engine instance.Answer
  2. B
    Attach the default Compute Engine service account to the VM instance and grant it the project-level Editor primitive role.
  3. C
    Generate a service account JSON key file, grant the developer the Service Account Admin role, and embed the key file directly into the application source code.
  4. D
    Configure Customer-Supplied Encryption Keys (CSEK) on the Cloud Storage bucket and store the raw encryption key in an unencrypted startup script on the VM.

Answer

Create a user-managed service account with the Storage Object Viewer role assigned to it, and attach this service account to the Compute Engine instance.
The optimal architecture attaches a user-managed service account with minimal predefined roles (Storage Object Viewer) directly to the Compute Engine instance. This enables seamless authentication via the metadata server without exporting service account keys or granting excessive permissions.

Step-by-Step Solution

1
Identify the minimum required permission for the workload.
The application only needs to read objects in Cloud Storage, which maps to the predefined role Storage Object Viewer.
Following the principle of least privilege ensures the workload has no extra permissions beyond what is strictly necessary.
2
Select the secure credential delivery mechanism for GCP workloads.
Attach a custom user-managed service account to the Compute Engine instance.
Attaching the service account allows the application to authenticate automatically using Application Default Credentials (ADC) without generating or managing long-lived JSON service account keys.

Key Concept

Service Account Lifecycle and Least Privilege Security
Estimated Time:50s
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic