Examkin

Soru

Zorluk: OrtaCreating and Managing Service Accounts

A cloud engineer needs to configure access for an application running on a Compute Engine VM in project `prod-app-project`. The application must publish messages to a Cloud Pub/Sub topic in the same project. Following Google Cloud security best practices, access must follow the principle of least privilege without generating long-lived service account keys. Which set of `gcloud` commands correctly creates the service account and grants the minimum required access?

  1. Execute `gcloud iam service-accounts create app-runner-sa --display-name="App Runner SA"` and then run `gcloud projects add-iam-policy-binding prod-app-project --member="serviceAccount:[email protected]" --role="roles/pubsub.publisher"`.Cevap
  2. B
    Execute `gcloud iam service-accounts create app-runner-sa --display-name="App Runner SA"` and then run `gcloud projects add-iam-policy-binding prod-app-project --member="serviceAccount:[email protected]" --role="roles/editor"`.
  3. C
    Execute `gcloud iam service-accounts create app-runner-sa --display-name="App Runner SA"` and then run `gcloud iam service-accounts keys create key.json --iam-account=app-runner-sa@prod-app-project.iam.gserviceaccount.com` to download and attach service account credentials to the VM.
  4. D
    Execute `gcloud organizations add-iam-policy-binding MY_ORG_ID --member="serviceAccount:[email protected]" --role="roles/pubsub.admin"` to ensure cross-resource inheritance.

Cevap

Create the custom service account using `gcloud iam service-accounts create` and grant the specific predefined role `roles/pubsub.publisher` using `gcloud projects add-iam-policy-binding`.
Creating a dedicated service account and binding the `roles/pubsub.publisher` predefined role directly at the project level complies with security mandates by adhering to the principle of least privilege. Furthermore, attaching this service account directly to the VM eliminates the security risks associated with exported service account key files.

Adım Adım Çözüm

1
Identify the proper IAM identity strategy
Use a dedicated user-managed service account attached to the Compute Engine instance instead of default service accounts or static JSON keys.
Attaching a custom service account avoids managing security keys manually and adheres to GCP identity recommendations.
2
Select the least-privilege predefined IAM role
`roles/pubsub.publisher` grants permissions to publish messages to Cloud Pub/Sub topics.
Primitive roles like Editor or overly broad administrative roles like Pub/Sub Admin grant unnecessary permissions.
3
Formulate the exact `gcloud` CLI commands
`gcloud iam service-accounts create` creates the account, and `gcloud projects add-iam-policy-binding` binds the IAM role to the service account member.
This establishes the identity and enforces resource permissions at the appropriate project scope.

Anahtar Kavram

Creating User-Managed Service Accounts and Assigning Predefined Least-Privilege Roles via gcloud
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru