Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

A retail organization is setting up automated deployment pipelines to provision Compute Engine Managed Instance Groups (MIGs) across multiple zones for processing nightly inventory updates. The automation process requires creating virtual machine (VM) instances that run under a dedicated runtime service account with specific data access permissions. The security team insists on strictly adhering to the principle of least privilege for the deployment pipeline identity. Which IAM permission configuration should be applied to allow the deployment pipeline to provision the compute instances attached to the runtime service account?

  1. Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime service account to the deployment pipeline identity.Answer
  2. B
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level to the deployment pipeline identity.
  3. C
    Grant the Editor primitive role (roles/editor) at the project level to the deployment pipeline identity.
  4. D
    Provision a regional GKE Standard cluster instead of Compute Engine MIGs so that pod service account impersonation avoids needing IAM permissions.

Answer

Grant the Service Account User role (roles/iam.serviceAccountUser) on the target runtime service account to the deployment pipeline service account.
To attach a service account to a Compute Engine instance or instance template during resource provisioning, the deploying entity must possess the `iam.serviceAccounts.actAs` permission on that service account. Granting the `roles/iam.serviceAccountUser` role directly on the specific runtime service account enforces the principle of least privilege by allowing the pipeline to attach the identity without administrative or project-wide access.

Step-by-Step Solution

1
Identify the operational requirement
The deployment automation pipeline must attach an existing runtime service account to newly created Compute Engine VMs within a Managed Instance Group.
When a compute resource executes code, it assumes the identity of its assigned service account.
2
Evaluate required IAM permissions for impersonation/attachment
To attach a service account to a VM instance, the provisioning identity needs the `iam.serviceAccounts.actAs` permission contained within the Service Account User role.
This prevents users or automated pipelines from abusing higher-privileged service accounts without explicit authorization.
3
Apply least privilege scoping
Granting `roles/iam.serviceAccountUser` specifically on the target service account resource boundary ensures minimum necessary privilege.
Scoped resource-level binding satisfies enterprise security requirements without exposing administrative capabilities.

Key Concept

Compute Engine Service Account Attachment & IAM Least Privilege
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic