Examkin

Soru

Zorluk: OrtaCreating and Managing Service Accounts

A software engineering team is deploying a containerized microservice on a Compute Engine VM instance in the `finance-prod` project. The microservice needs permission to write log entries to Cloud Logging. Google Cloud security policies require following the principle of least privilege and avoiding long-lived credential exports for workloads hosted inside GCP. Which set of actions follows Google Cloud best practices to provision and grant access for this microservice?

  1. Create a user-managed service account named `app-logger-sa`, grant it the `roles/logging.logWriter` predefined role on project `finance-prod`, and attach the service account to the Compute Engine VM instance.Cevap
  2. B
    Create a user-managed service account named `app-logger-sa`, grant it the `roles/editor` primitive role on project `finance-prod`, and attach the service account to the Compute Engine VM instance.
  3. C
    Create a user-managed service account named `app-logger-sa`, grant it the `roles/logging.logWriter` predefined role, generate a JSON service account key file using `gcloud iam service-accounts keys create`, and copy the key file to the VM instance.
  4. D
    Create a user-managed service account named `app-logger-sa` in a central management project, grant it `roles/logging.logWriter` in `finance-prod`, and enable the Cloud Logging API exclusively in the central management project.

Cevap

Create a user-managed service account named `app-logger-sa`, grant it the `roles/logging.logWriter` predefined role on project `finance-prod`, and attach the service account to the Compute Engine VM instance.
The solution that creates a dedicated service account, assigns the narrow `roles/logging.logWriter` predefined role, and attaches it directly to the VM instance follows both least privilege and GCP identity security standards by using default instance metadata authentication rather than static key files.

Adım Adım Çözüm

1
Identify the required identity type and role
A dedicated user-managed service account with the predefined `roles/logging.logWriter` role provides the exact minimum permissions required to write log entries.
Applying predefined roles instead of primitive roles enforces the security principle of least privilege.
2
Determine the authentication mechanism for GCP-hosted workloads
Attach the service account directly to the Compute Engine instance metadata service upon VM creation or update.
Workloads running on Google Cloud infrastructure obtain short-lived tokens automatically via the metadata server, eliminating the operational security risk of exported long-lived JSON keys.

Anahtar Kavram

Service Account Creation and Least-Privilege Identity Management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru