An engineer needs to provision a dedicated Google Cloud service account for an internal reporting application running on a Compute Engine virtual machine instance. The application needs read-only access to objects in a specific Cloud Storage bucket. Place the following gcloud CLI operations in the correct chronological order required to create the service account, grant it the necessary IAM role, and attach it to the virtual machine instance during creation.
- 1Execute `gcloud iam service-accounts create app-reporter --display-name="App Reporter SA"` to create the user-managed service account.
- 2Execute `gcloud storage buckets add-iam-policy-binding gs://analytics-report-data --member="serviceAccount:[email protected]" --role="roles/storage.objectViewer"` to grant bucket access.
- 3Execute `gcloud compute instances create reporting-vm --zone=us-central1-a --service-account="[email protected]" --scopes="https://www.googleapis.com/auth/cloud-platform"` to launch the virtual machine.
Cevap
The correct sequence is to first create the service account identity, second bind the storage object viewer IAM role to the service account on the Cloud Storage bucket, and third create the Compute Engine VM attached to the configured service account.
To properly set up a non-human identity in Google Cloud, you must follow the lifecycle dependency order: first, define the service account principal (`gcloud iam service-accounts create`); second, grant it specific permissions via IAM bindings (`gcloud storage buckets add-iam-policy-binding`); and third, associate the fully configured identity with the compute infrastructure (`gcloud compute instances create --service-account=...`).
Adım Adım Çözüm
Anahtar Kavram
Creating and binding a custom service account to a Compute Engine virtual machine instance following least-privilege security principles.