A deployment script needs to provision a dedicated user-managed service account named `data-processor-sa` in project `finance-analytics` and grant it read-only access to objects inside a specific Cloud Storage bucket `gs://finance-raw-data`. Following Google Cloud security best practices and the principle of least privilege, which sequence of `gcloud` commands should be executed to create the service account and assign the required access?
- gcloud iam service-accounts create data-processor-sa --display-name="Data Processor SA"
gcloud storage buckets add-iam-policy-binding gs://finance-raw-data --member="serviceAccount:[email protected]" --role="roles/storage.objectViewer"Cevap - Bgcloud iam service-accounts create data-processor-sa --display-name="Data Processor SA"
gcloud iam service-accounts keys create key.json --iam-account="[email protected]" - Cgcloud iam service-accounts create data-processor-sa --display-name="Data Processor SA"
gcloud projects add-iam-policy-binding finance-analytics --member="serviceAccount:[email protected]" --role="roles/editor" - Dgcloud services enable storage.googleapis.com --project=finance-raw-data
gcloud projects add-iam-policy-binding finance-analytics --member="serviceAccount:[email protected]" --role="roles/viewer"
Cevap
Create the service account using 'gcloud iam service-accounts create' and then grant object read permissions on the bucket using 'gcloud storage buckets add-iam-policy-binding' with the 'roles/storage.objectViewer' role.
Creating the service account establishes an identity for the workload. Granting the 'roles/storage.objectViewer' role directly on the specific Cloud Storage bucket 'gs://finance-raw-data' provides exact read access to objects without exposing other resources or project-level configurations.
Adım Adım Çözüm
Anahtar Kavram
Creating service accounts and binding predefined IAM roles at the resource level.
Tahmini Süre:1m 30s