Examkin

Soru

Zorluk: OrtaCreating and Managing Service Accounts

An engineering team runs an automated batch processing pipeline on a Compute Engine virtual machine residing in `project-analytics`. The script needs to read raw log files stored in a Cloud Storage bucket inside `project-data`. Following Google Cloud security best practices for least privilege and identity management, which approach should be taken to grant the VM access to the storage bucket?

  1. Create a dedicated service account in `project-analytics`, grant it the Storage Object Viewer role (`roles/storage.objectViewer`) on the target bucket in `project-data`, and attach this service account to the VM instance.Cevap
  2. B
    Create a dedicated service account in `project-analytics`, generate a downloadable JSON service account key file, and store it on the VM instance's local persistent disk for application authentication.
  3. C
    Create a dedicated service account in `project-analytics`, grant it the Editor primitive role (`roles/editor`) at the project level on `project-data`, and attach this service account to the VM instance.
  4. D
    Grant the default Compute Engine service account the Viewer role at the organization level so that permissions inherit across all projects within the resource hierarchy.

Cevap

Create a dedicated service account in the source project (`project-analytics`), assign it the predefined `roles/storage.objectViewer` role scoped to the target bucket in `project-data`, and attach the service account to the Compute Engine VM instance.
The correct response adheres to Google Cloud security best practices by creating a dedicated user-managed service account, assigning only the minimum required predefined role (`roles/storage.objectViewer`) directly on the Cloud Storage bucket resource in the destination project, and attaching the service account directly to the Compute Engine VM. This avoids using exported service account keys while strictly enforcing least privilege.

Adım Adım Çözüm

1
Identify the authentication mechanism for Google Cloud workloads.
Determine that workloads running inside Compute Engine should use attached user-managed service accounts rather than exported JSON keys.
Attaching a service account directly to the VM leverages automatic metadata server token generation, eliminating long-lived key storage.
2
Determine the necessary IAM role adhering to the principle of least privilege.
Select the predefined `roles/storage.objectViewer` role instead of broad primitive roles like Editor or Owner.
The workload only requires read permissions for Cloud Storage objects.
3
Scope the IAM role binding to the appropriate resource node.
Bind the service account to the target Cloud Storage bucket resource in `project-data`.
Cross-project access is securely achieved by granting resource-level permissions in the target project to a service account identity living in the source project.

Anahtar Kavram

Cross-Project Service Account Access and IAM Least Privilege Best Practices
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru