Soru

Zorluk: OrtaDeploying and Managing Compute Engine Virtual Machines

A system administrator needs to deploy a new Compute Engine virtual machine instance named `analytics-node-1` in zone `us-central1-a` using the `gcloud` CLI. The instance must run using a custom service account named `[email protected]`. To adhere to Google Cloud security best practices, access control should be strictly managed by the IAM roles assigned to the service account rather than restricted by access scopes. Which `gcloud compute instances create` command correctly configures the instance with these access settings?

  1. gcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platformCevap
  2. B
    gcloud compute instances create analytics-node-1 --zone=us-central1-a [email protected]
  3. C
    gcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --preemptible
  4. D
    gcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --role=roles/owner

Cevap

The command that uses --service-account=analytics-sa@my-project.iam.gserviceaccount.com along with --scopes=https://www.googleapis.com/auth/cloud-platform correctly attaches the custom service account while allowing IAM roles to control API access permissions.
The correct approach attaches the custom service account via the `--service-account` flag and grants it the `cloud-platform` access scope via `--scopes`. This ensures that GCP API access limits are not artificially restricted by legacy scopes, allowing the IAM roles assigned to the service account to determine exact permissions.

Adım Adım Çözüm

1
Identify the CLI flag used to attach a custom service account to a Compute Engine VM instance
The correct flag is `--service-account=<SA_EMAIL>`.
The service account identity must be assigned directly at creation or instance update using its specific CLI flag.
2
Determine the recommended access scope setting for custom service accounts
Assign the `cloud-platform` scope (`https://www.googleapis.com/auth/cloud-platform`).
Google Cloud best practice recommends enabling full API access (`cloud-platform` scope) on the VM level and using IAM roles on the service account to enforce the principle of least privilege.

Anahtar Kavram

Attaching Service Accounts and Scopes to Compute Engine Instances
Bu soruyu puanla