Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise deployment team uses an automated deployment service account to manage Compute Engine virtual machines in a dedicated Google Cloud folder named `App-Development`. The automated pipeline must be able to provision compute instances within this folder and assign a specific runtime service account (`app-runner-sa@`) to those instances. Following Google-recommended security practices and the principle of least privilege, which TWO IAM configuration steps should you execute?

  1. Grant the predefined `roles/compute.instanceAdmin.v1` role to the deployment service account bound at the `App-Development` folder level.Answer
  2. Grant the `roles/iam.serviceAccountUser` role to the deployment service account directly on the `app-runner-sa@` resource.Answer
  3. C
    Grant the `roles/iam.serviceAccountAdmin` role to the deployment service account at the project level.
  4. D
    Grant the primitive `roles/editor` role to the deployment service account bound at the Organization root level.

Answer

The correct configurations are to grant the Compute Instance Admin role to the deployment service account at the folder level and grant the Service Account User role specifically on the runtime service account resource.
To provision Compute Engine instances within a folder structure while adhering to least privilege, permissions should be scoped at the specific folder level using predefined roles (`roles/compute.instanceAdmin.v1`). Furthermore, allowing an identity to attach a service account to a compute instance requires the `roles/iam.serviceAccountUser` role scoped specifically to the target service account identity.

Step-by-Step Solution

1
Determine compute management scope
Identify that `roles/compute.instanceAdmin.v1` should be assigned on the `App-Development` folder node to leverage resource hierarchy inheritance across child projects.
Granting permissions at the folder level enforces administrative boundary constraints and operational efficiency without granting organization-wide access.
2
Determine service account impersonation/use scope
Identify that the deployment pipeline needs to attach `app-runner-sa@` to new VMs, which requires `roles/iam.serviceAccountUser` on that specific service account identity.
Bounding `roles/iam.serviceAccountUser` to the target service account resource ensures the pipeline cannot attach other sensitive service accounts in the project.

Key Concept

Resource Hierarchy IAM Role Inheritance and Service Account User Granular Delegation
Estimated Time:2m 0s
Rate this question