A system administrator needs to deploy a new Compute Engine virtual machine instance named `analytics-node-1` in zone `us-central1-a` using the `gcloud` CLI. The instance must run using a custom service account named `[email protected]`. To adhere to Google Cloud security best practices, access control should be strictly managed by the IAM roles assigned to the service account rather than restricted by access scopes. Which `gcloud compute instances create` command correctly configures the instance with these access settings?
- gcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platformCevap
- Bgcloud compute instances create analytics-node-1 --zone=us-central1-a [email protected]
- Cgcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --preemptible
- Dgcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --role=roles/owner
Cevap
The command that uses --service-account=analytics-sa@my-project.iam.gserviceaccount.com along with --scopes=https://www.googleapis.com/auth/cloud-platform correctly attaches the custom service account while allowing IAM roles to control API access permissions.
The correct approach attaches the custom service account via the `--service-account` flag and grants it the `cloud-platform` access scope via `--scopes`. This ensures that GCP API access limits are not artificially restricted by legacy scopes, allowing the IAM roles assigned to the service account to determine exact permissions.
Adım Adım Çözüm
Anahtar Kavram
Attaching Service Accounts and Scopes to Compute Engine Instances