Examkin

Soru

Zorluk: ZorCreating and Managing Service Accounts

A cloud engineer needs to configure a Google Compute Engine VM instance to securely access objects in a Cloud Storage bucket following Google Cloud security best practices and least-privilege principles. Arrange the procedural steps in the correct sequential order from first to last.

  1. 1Create a custom user-managed service account in the GCP project using the gcloud command line tool.
  2. 2Grant the Storage Object Viewer role (roles/storage.objectViewer) to the newly created service account specifically on the target Cloud Storage bucket.
  3. 3Provision the Compute Engine VM instance and specify the custom service account as its identity, overriding the default Compute Engine service account.
  4. 4Execute the application on the VM instance using Google Application Default Credentials (ADC) without generating or storing long-lived service account key files.

Cevap

The correct sequence begins with creating the custom user-managed service account, followed by granting the specific storage IAM role to that service account, attaching the custom service account identity to the Compute Engine VM, and finally running the workload utilizing Application Default Credentials (ADC).
The correct operational order follows standard GCP security lifecycle practices: first, define the custom service account identity; second, delegate minimal resource-level IAM roles to that identity; third, attach the identity to the Compute Engine VM; and fourth, run the application using non-static Application Default Credentials (ADC) fetched from the metadata server.

Adım Adım Çözüm

1
Create a custom user-managed service account identity using 'gcloud iam service-accounts create'.
A unique service account email identity is generated within the Google Cloud project.
Before permissions can be configured or assigned, the dedicated service account principal must exist.
2
Bind the predefined role 'roles/storage.objectViewer' to the service account email on the designated Cloud Storage bucket.
The service account gains read access to objects inside the target bucket according to the principle of least privilege.
Resource-level IAM permissions should be configured before attaching identity to running workloads.
3
Attach the custom service account to the Compute Engine VM instance during instance creation using '--service-account'.
The metadata server of the VM instance is configured to mint tokens for the custom service account instead of the default compute service account.
Attaching custom identities avoids using default service accounts that often carry overly permissive Editor roles.
4
Configure and execute the workload to authenticate using Google Application Default Credentials (ADC).
The application automatically queries the VM instance metadata server for short-lived access tokens without requiring exported JSON service account keys.
Google Cloud security best practices strongly discourage exporting and managing static service account keys.

Anahtar Kavram

Service Account Creation, Least Privilege Role Binding, and Compute Engine Attachment via Application Default Credentials
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru