Soru

Zorluk: OrtaCreating and Managing Service Accounts

A deployment script needs to provision a dedicated user-managed service account named `data-processor-sa` in project `finance-analytics` and grant it read-only access to objects inside a specific Cloud Storage bucket `gs://finance-raw-data`. Following Google Cloud security best practices and the principle of least privilege, which sequence of `gcloud` commands should be executed to create the service account and assign the required access?

  1. gcloud iam service-accounts create data-processor-sa --display-name="Data Processor SA"
    gcloud storage buckets add-iam-policy-binding gs://finance-raw-data --member="serviceAccount:[email protected]" --role="roles/storage.objectViewer"
    Cevap
  2. B
    gcloud iam service-accounts create data-processor-sa --display-name="Data Processor SA"
    gcloud iam service-accounts keys create key.json --iam-account="[email protected]"
  3. C
    gcloud iam service-accounts create data-processor-sa --display-name="Data Processor SA"
    gcloud projects add-iam-policy-binding finance-analytics --member="serviceAccount:[email protected]" --role="roles/editor"
  4. D
    gcloud services enable storage.googleapis.com --project=finance-raw-data
    gcloud projects add-iam-policy-binding finance-analytics --member="serviceAccount:[email protected]" --role="roles/viewer"

Cevap

Create the service account using 'gcloud iam service-accounts create' and then grant object read permissions on the bucket using 'gcloud storage buckets add-iam-policy-binding' with the 'roles/storage.objectViewer' role.
Creating the service account establishes an identity for the workload. Granting the 'roles/storage.objectViewer' role directly on the specific Cloud Storage bucket 'gs://finance-raw-data' provides exact read access to objects without exposing other resources or project-level configurations.

Adım Adım Çözüm

1
Create the dedicated user-managed service account
The identity '[email protected]' is provisioned.
Applications and deployment scripts should use dedicated user-managed service accounts rather than default compute identities.
2
Bind the minimum necessary IAM role at the bucket level
The service account gains read-only access strictly on 'gs://finance-raw-data'.
Applying the predefined role 'roles/storage.objectViewer' directly on the target resource adheres to the principle of least privilege.

Anahtar Kavram

Creating service accounts and binding predefined IAM roles at the resource level.
Tahmini Süre:1m 30s
Bu soruyu puanla