A smart grid energy company is configuring identity and access management for an IoT telemetry processing application hosted on Compute Engine instances within a dedicated project. The application must read telemetry configuration files from a Cloud Storage bucket and write metric data to Cloud Monitoring. Additionally, developer teams require permissions to deploy updated Compute Engine instances using the application's service account without acquiring administrative access to IAM policies or other resources. Which TWO architectural recommendations follow Google-recommended security best practices? (Select TWO.)
- Grant the workload service account fine-grained predefined roles, specifically Storage Object Viewer (roles/storage.objectViewer) and Metric Writer (roles/monitoring.metricWriter), scoped at the project level.Cevap
- BGrant the workload service account the primitive Editor role (roles/editor) at the project level to cover both Cloud Storage and Cloud Monitoring access requirements.
- Grant developers the Service Account User role (roles/iam.serviceAccountUser) specifically bound to the workload service account identity.Cevap
- DGrant developers the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level so they can manage and attach compute service accounts.
Cevap
The optimal solution requires granting fine-grained predefined roles (Storage Object Viewer and Metric Writer) to the workload service account, and granting developers the Service Account User role scoped directly to the workload service account.
Following Google Cloud security best practices, workloads should be assigned specific predefined roles (such as Storage Object Viewer and Metric Writer) that match their functional requirements. To allow developers to attach this service account to instances without granting elevated administrative rights, developers should be granted the Service Account User role specifically on the target service account resource.
Adım Adım Çözüm
Anahtar Kavram
Applying Least Privilege with Predefined Roles and Service Account User Scoping