An enterprise organization uses a Google Cloud resource hierarchy structured with dedicated folders for Production, Staging, and Development. A central deployment pipeline requires automated authorization to provision Compute Engine instances across all projects under the Production folder. Additionally, the deployment pipeline must attach a dedicated workload service account to these newly provisioned instances. You must enforce the principle of least privilege while minimizing management complexity. Which TWO IAM configuration steps should you execute? (Select TWO.)
- Grant the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) to the deployment pipeline service account at the Production folder level.Cevap
- Grant the Service Account User role (roles/iam.serviceAccountUser) to the deployment pipeline service account directly on the target workload service account.Cevap
- CGrant the Editor primitive role (roles/editor) to the deployment pipeline service account at the Organization node level.
- DGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the deployment pipeline service account at the Production folder level.
Cevap
Grant the Compute Instance Admin (v1) role to the deployment pipeline service account at the Production folder level, and grant the Service Account User role to the deployment pipeline service account directly on the workload service account resource.
Granting Compute Instance Admin (v1) at the Production folder level applies policy inheritance to automatically encompass all projects within that folder, meeting least privilege and avoiding per-project maintenance. Granting Service Account User specifically on the workload service account resource allows the deployment identity to attach it to VM instances without exposing administrative control over the service account itself.
Adım Adım Çözüm
Anahtar Kavram
Resource Hierarchy IAM Policy Inheritance & Fine-Grained Service Account Impersonation