An e-commerce organization is implementing an automated deployment pipeline to provision Compute Engine virtual machine instances for an order processing backend service. A dedicated custom service account was created to provide runtime permissions for the application on these instances. However, when the automated pipeline executes, instance creation fails with an IAM authorization error when trying to bind the custom service account to the virtual machines. Which configuration change should the cloud architect implement to resolve this provisioning error while adhering to the principle of least privilege?
- Grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the target custom service account.Cevap
- BGrant the deployment pipeline service account the Service Account Admin role (roles/iam.serviceAccountAdmin) on the project level.
- CAssign the primitive Editor role (roles/editor) to the custom service account attached to the Compute Engine instances.
- DMigrate the order processing service to a Google Kubernetes Engine (GKE) cluster in Autopilot mode to handle identity binding automatically.
Cevap
Grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the target custom service account.
When an automated pipeline provisions Compute Engine virtual machines configured to run under a custom service account, the entity issuing the creation command must have permission to use that service account. Granting the `roles/iam.serviceAccountUser` role on the target service account permits the deployment pipeline to attach it to the virtual machine instances while strictly maintaining least privilege constraints.
Adım Adım Çözüm
Anahtar Kavram
Compute Engine Service Account Attachment Permissions