An organization is deploying a Compute Engine virtual machine instance named `data-worker` to process batch analytics. The application running inside `data-worker` must read files from a Cloud Storage bucket using a custom service account named `[email protected]`. To follow Google Cloud security best practices, the custom service account has been granted only the Storage Object Viewer IAM role on the bucket. Which `gcloud compute instances create` command correctly attaches the custom service account while allowing IAM roles to govern the instance's access?
- gcloud compute instances create data-worker --service-account=processing-sa@prod-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platformCevap
- Bgcloud compute instances create data-worker [email protected]
- Cgcloud compute instances create data-worker --provisioning-model=SPOT --instance-termination-action=DELETE
- Dgcloud compute instances create data-worker --service-account=default --scopes=roles/owner
Cevap
Execute gcloud compute instances create data-worker --service-account=processing-sa@prod-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform
When creating a Compute Engine VM with a custom service account, Google Cloud best practice requires attaching the service account via the --service-account flag and setting the scope to https://www.googleapis.com/auth/cloud-platform. This allows IAM permissions granted to that service account to serve as the effective boundary for Google Cloud API requests.
Adım Adım Çözüm
Anahtar Kavram
Attaching custom service accounts and configuring access scopes during Compute Engine VM deployment