A DevOps engineer is configuring a Python application running on a Compute Engine virtual machine in project `project-app`. The application must read log objects stored in a Cloud Storage bucket named `analytics-data-archive` located in project `project-data`. Following Google Cloud security best practices and the principle of least privilege, which TWO actions should be performed to configure access for the virtual machine?
- Attach a dedicated user-managed service account to the Compute Engine virtual machine instance.Cevap
- Grant the user-managed service account the Storage Object Viewer role (`roles/storage.objectViewer`) on the `analytics-data-archive` bucket.Cevap
- CCreate a service account key in JSON format and store it in the application configuration directory on the virtual machine.
- DGrant the user-managed service account the primitive Editor role (`roles/editor`) at the `project-data` project level.
- EGrant the Compute Engine default service account the Storage Admin role (`roles/storage.admin`) at the Organization level so permissions inherit downwards.
Cevap
The correct configuration requires attaching a dedicated user-managed service account to the Compute Engine virtual machine and granting that service account the Storage Object Viewer role (`roles/storage.objectViewer`) directly on the specific Cloud Storage bucket.
Google Cloud security best practices dictate attaching a dedicated user-managed service account to the Compute Engine VM so that applications automatically authenticate via Application Default Credentials (ADC). Furthermore, applying the predefined Storage Object Viewer role (`roles/storage.objectViewer`) directly to the target bucket ensures cross-project access is granted strictly according to the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Cross-project service account access using attached service accounts and least-privilege resource-level role bindings.