A DevOps engineer needs to configure access for a service account so that deployment pipelines can attach it to newly created Compute Engine virtual machine instances within a development project. The pipeline should not be granted administrative control over other service accounts or broad management rights over project resources. Which IAM role assignment strategy follows Google Cloud's principle of least privilege?
- Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific target service account resource.Cevap
- BGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level.
- CGrant the primitive Editor role (roles/editor) on the parent folder containing the project.
- DConfigure VPC Service Controls perimeter rules without assigning IAM permissions.
Cevap
Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific target service account resource.
Granting the Service Account User role (roles/iam.serviceAccountUser) bound specifically to the target service account resource allows the deployment identity to attach that service account to Compute Engine instances. This directly satisfies the requirement using the fine-grained predefined role and narrowest resource scope possible.
Adım Adım Çözüm
Anahtar Kavram
Applying Least Privilege with Service Account User Roles and Hierarchy Scoping