Examkin

Soru

Zorluk: ZorCreating and Managing Service Accounts

A database administrator needs to allow an automated data extraction script, executing on a Compute Engine virtual machine instance in project `analytics-prod`, to read raw dataset files stored in a Cloud Storage bucket located inside a separate project `data-lake-central`. The Compute Engine instance is already configured to run with a custom user-managed service account named `[email protected]`. Following Google Cloud security best practices for cross-project resource access and the principle of least privilege, which configuration should the administrator apply?

  1. Grant the Storage Object Viewer role (`roles/storage.objectViewer`) on the specific Cloud Storage bucket in `data-lake-central` directly to `[email protected]`.Cevap
  2. B
    Generate a static JSON service account key for a service account created in `data-lake-central`, store the file on the Compute Engine VM, and authenticate using the key file.
  3. C
    Grant the primitive Editor role (`roles/editor`) at the project level of `data-lake-central` to `[email protected]`.
  4. D
    Create a new service account in `data-lake-central`, grant it the Storage Admin role, and restrict access on the Compute Engine VM in `analytics-prod` by applying a deny IAM policy at the VM level.

Cevap

Grant the Storage Object Viewer role (roles/storage.objectViewer) on the specific Cloud Storage bucket in data-lake-central directly to [email protected].
Service accounts can be granted IAM roles on resources in different Google Cloud projects. Granting the predefined role `roles/storage.objectViewer` on the specific bucket directly to the custom service account email address fulfills the least privilege requirement safely without key export overhead.

Adım Adım Çözüm

1
Identify the existing identity running the workload.
The identity is the custom service account [email protected].
Compute Engine workloads should leverage attached service accounts and Google Application Default Credentials (ADC).
2
Determine the minimal required role on the target resource.
The Storage Object Viewer role (roles/storage.objectViewer) provides read access to objects inside the Cloud Storage bucket.
Adhering to the principle of least privilege prevents unnecessary access write or administrative permissions.
3
Apply IAM binding directly on the target resource in the destination project.
The cross-project IAM policy binding allows the service account in project analytics-prod to read data from the bucket in project data-lake-central without long-lived keys.
GCP IAM supports referencing service account principal IDs across project boundaries.

Anahtar Kavram

Cross-Project Service Account Resource Access and Least Privilege
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru