Your enterprise security policy strictly forbids downloading exportable service account keys. You are tasked with provisioning a Compute Engine virtual machine instance in `prod-app-project` that requires read access to a BigQuery dataset located in `prod-analytics-project`. Arrange the administrative actions in the correct chronological sequence to configure and attach a custom service account under least-privilege best practices.
- 1Create a dedicated custom service account inside `prod-app-project`.
- 2Grant the `roles/bigquery.dataViewer` role to the custom service account on the specific dataset in `prod-analytics-project`.
- 3Grant the `roles/iam.serviceAccountUser` role on the custom service account to the VM deployment principal in `prod-app-project`.
- 4Provision the Compute Engine VM instance in `prod-app-project` configured with the newly created custom service account identity.
Cevap
The correct operational sequence begins by creating the custom service account in the source project, granting cross-project dataset access to that identity, assigning the Service Account User role to the provisioning principal, and finally attaching the service account during VM creation.
Establishing a keyless cross-project workload identity requires sequential execution: creating the service account identity in the home project, granting the service account resource-level access in the destination project, delegating Service Account User permissions to the deployment principal, and finally binding the service account to the Compute Engine instance.
Adım Adım Çözüm
Anahtar Kavram
Cross-Project Service Account Management and Compute Engine IAM Attachment