An enterprise deployment team uses an automated deployment service account to manage Compute Engine virtual machines in a dedicated Google Cloud folder named `App-Development`. The automated pipeline must be able to provision compute instances within this folder and assign a specific runtime service account (`app-runner-sa@`) to those instances. Following Google-recommended security practices and the principle of least privilege, which TWO IAM configuration steps should you execute?
- Grant the predefined `roles/compute.instanceAdmin.v1` role to the deployment service account bound at the `App-Development` folder level.Answer
- Grant the `roles/iam.serviceAccountUser` role to the deployment service account directly on the `app-runner-sa@` resource.Answer
- CGrant the `roles/iam.serviceAccountAdmin` role to the deployment service account at the project level.
- DGrant the primitive `roles/editor` role to the deployment service account bound at the Organization root level.
Answer
The correct configurations are to grant the Compute Instance Admin role to the deployment service account at the folder level and grant the Service Account User role specifically on the runtime service account resource.
To provision Compute Engine instances within a folder structure while adhering to least privilege, permissions should be scoped at the specific folder level using predefined roles (`roles/compute.instanceAdmin.v1`). Furthermore, allowing an identity to attach a service account to a compute instance requires the `roles/iam.serviceAccountUser` role scoped specifically to the target service account identity.
Step-by-Step Solution
Key Concept
Resource Hierarchy IAM Role Inheritance and Service Account User Granular Delegation
Estimated Time:2m 0s