Google Associate Cloud Engineer Question 345
Select 3Google Cloud PlatformAs a Google Cloud Associate Cloud Engineer, you need to create a service account for an application that will run on Google Kubernetes Engine (GKE) and requires access to Google Cloud Storage and Pub/Sub. Which of the following steps should you take to ensure the service account has the necessary permissions while following the principle of least privilege?
- A
Create a new service account in Google Cloud IAM.
- B
Grant the service account the 'Editor' role at the project level.
- C
Assign only the 'Storage Object Viewer' role to the service account on the specific Cloud Storage bucket.
- D
Grant the service account the 'Pub/Sub Subscriber' role for the necessary Pub/Sub subscription.
- E
Enable the 'Service Account User' role for the service account on the GKE nodes.
Show answer and explanation
Correct answers: A, C, D
Explanation
To follow the principle of least privilege, the service account should only be granted the permissions it needs to function. Creating a new service account allows you to assign specific roles. The 'Storage Object Viewer' and 'Pub/Sub Subscriber' roles are specific to the resources the application needs to access, thus minimizing unnecessary permissions.
- A. Correct.
Creating a new service account is necessary to assign specific roles that match the application's requirements.
- B. Incorrect.
Granting the 'Editor' role at the project level is too broad and violates the principle of least privilege.
- C. Correct.
Assigning the 'Storage Object Viewer' role on the specific bucket ensures the service account has only the necessary permissions for accessing that bucket.
- D. Correct.
Granting the 'Pub/Sub Subscriber' role allows the service account to access the specific Pub/Sub subscription it needs, adhering to the principle of least privilege.
- E. Incorrect.
The 'Service Account User' role is not required for this scenario as it is used for user impersonation, which is not needed here.