Examkin

Soru

Zorluk: KolayCreating and Managing Service Accounts

You need to provision a Compute Engine virtual machine that requires access to Cloud Storage, following Google Cloud identity best practices. Arrange the administrative steps in the correct logical sequence to create, grant permissions to, and assign a custom service account to the instance.

  1. 1Create a new custom service account using the gcloud iam service-accounts create command.
  2. 2Grant the required IAM roles (e.g., roles/storage.objectViewer) to the service account at the project level.
  3. 3Grant the deployment user the Service Account User role (roles/iam.serviceAccountUser) on the service account.
  4. 4Create the Compute Engine instance specifying the --service-account flag with the service account email address.

Cevap

The correct order is: 1) Create the dedicated service account, 2) Grant the required resource IAM roles to the service account, 3) Grant the deployment identity the Service Account User role, 4) Create the Compute Engine instance with the service account attached.
The correct workflow begins by creating the service account identity, defining its resource access permissions next, delegating usage rights to the deployer third, and attaching the service account to the VM instance during creation fourth.

Adım Adım Çözüm

1
Create the Service Account identity
The service account identity is established in the project.
You must create the service account identity before granting roles or attaching it to resources.
2
Assign IAM roles to the Service Account
Service account gains specific resource permissions.
Following least privilege, assign predefined roles directly to the service account before running workloads.
3
Grant Service Account User role to the deployer identity
Deployer receives authorization to bind the service account to resources.
Attaching a service account to a compute resource requires the roles/iam.serviceAccountUser role on the target service account.
4
Attach the Service Account during Compute Engine VM creation
VM instance runs using the identity of the custom service account.
The compute instance consumes the credentials of the assigned service account without requiring exported static JSON keys.

Anahtar Kavram

Sequential lifecycle of creating, granting permissions to, delegating use of, and attaching service accounts in Google Cloud.
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru