An operations team is deploying a microservice application to Compute Engine instances. To ensure deployment scripts execute cleanly without permission errors, the team lead plans to assign the primitive Owner role (roles/owner) to the deployment service account. As a Cloud Architect advising the operations team, which recommendation aligns with Google Cloud security best practices?
- Assign predefined or custom fine-grained roles following the principle of least privilege instead of primitive roles.Cevap
- BProceed with assigning the Owner role to prevent deployment scripts from failing due to permission issues.
- CAssign the Service Account Admin role to the service account so it has full administrative control over IAM resources.
- DDownload a static JSON service account key with Owner permissions and commit it directly to the deployment code repository.
Cevap
Assign predefined or custom fine-grained roles following the principle of least privilege instead of primitive roles.
Advising development and operation teams on cloud architecture implementation requires enforcing Google Cloud IAM security best practices. Service accounts used in automated pipelines should strictly adhere to the principle of least privilege by receiving specific predefined or custom roles rather than primitive roles like Owner or Editor.
Adım Adım Çözüm
Anahtar Kavram
IAM Least Privilege Best Practices when Advising DevOps Teams