A security administrator needs to allow internal HTTPS traffic on TCP port 443 strictly to a set of Compute Engine virtual machines running a financial application within the custom VPC network `finance-vpc`. To prevent instance administrators from bypassing security policy by modifying instance network tags, the security team mandates that the firewall rule must be enforced based on the service identity of the virtual machines rather than arbitrary metadata tags. Which parameter should the administrator specify when configuring the ingress firewall rule?
- Specify the `--target-service-accounts` flag set to the email address of the service account attached to the financial application virtual machines.Cevap
- BSpecify the `--target-tags` flag set to the service account email address of the financial application virtual machines.
- CSpecify the `--source-service-accounts` flag set to the financial application service account email and set the rule direction to egress.
- DSpecify the `--roles` flag set to the IAM role assigned to the financial application virtual machine instance.
Cevap
Specify the `--target-service-accounts` flag set to the email address of the service account attached to the financial application virtual machines.
In Google Cloud VPC networks, firewall rules can target instances using network tags or service accounts. When strict security policy is required, using `--target-service-accounts` ensures that access is bound to the instance's authenticated IAM service account identity. Because attaching a service account requires the `iam.serviceAccountUser` role, standard VM instance administrators cannot modify network controls by simply altering instance tags.
Adım Adım Çözüm
Anahtar Kavram
Identity-Based VPC Firewall Rule Targeting via Service Accounts
Tahmini Süre:1m 30s