Google Associate Cloud Engineer Question 351
Single answerGoogle Cloud PlatformYou are managing a Google Cloud project where an application running on Compute Engine needs to access objects in a specific Cloud Storage bucket. To comply with the principle of least privilege, you need to assign the minimum permissions necessary to a service account that the VM instances will use. Which role should you assign to the service account to achieve this?
- A
Storage Admin
- B
Storage Object Viewer
- C
Storage Object Creator
- D
Storage Object Admin
Show answer and explanation
Correct answer: B
Explanation
To adhere to the principle of least privilege, it is important to grant only the permissions necessary for the task. In this scenario, since the application only needs to access (view) objects in the Cloud Storage bucket, the 'Storage Object Viewer' role is the most appropriate choice as it provides the needed read-only access without any additional permissions that are not required.
- A. Incorrect.
Storage Admin provides full control over all Cloud Storage resources, which exceeds the minimum required permissions for just viewing objects.
- B. Correct.
Storage Object Viewer grants read-only access to objects within the bucket, which aligns with the requirement to access objects while adhering to the principle of least privilege.
- C. Incorrect.
Storage Object Creator allows the service account to create objects in the bucket but does not permit viewing them, so it does not meet the requirement.
- D. Incorrect.
Storage Object Admin allows full management of objects within the bucket, which is more than what is required for just accessing them.