Google Associate Cloud Engineer Question 353
Single answerGoogle Cloud PlatformYou are managing a Google Cloud project that requires a Compute Engine instance to access data stored in a Cloud Storage bucket. You want to ensure that the instance has the minimum necessary permissions to read the data. Which IAM role should you assign to the service account used by the Compute Engine instance to achieve this?
- A
Viewer
- B
Storage Object Viewer
- C
Storage Admin
- D
Editor
Show answer and explanation
Correct answer: B
Explanation
To ensure the Compute Engine instance has the minimum necessary permissions to read data from a Cloud Storage bucket, the 'Storage Object Viewer' role should be assigned to the service account. This role allows read access to objects in Cloud Storage without granting unnecessary permissions.
- A. Incorrect.
The Viewer role is too broad as it grants read access to all resources in the project, not just Cloud Storage.
- B. Correct.
The Storage Object Viewer role provides read access to objects in Cloud Storage, which is the minimum permission needed for this task.
- C. Incorrect.
The Storage Admin role is too broad as it grants full control over storage resources, including modifying and deleting them.
- D. Incorrect.
The Editor role is also too broad and grants permissions to modify all resources in the project, not just read access to Cloud Storage.