Google Associate Cloud Engineer Question 354
Single answerGoogle Cloud PlatformYou are a Google Cloud Engineer responsible for managing IAM policies for your organization's cloud resources. Your team has developed a new application that needs to access Google Cloud Storage to read files. The application runs in a Compute Engine instance and uses a service account for authentication. How can you grant the service account the minimum necessary permissions to perform this task?
- A
Grant the service account the 'Editor' role on the project.
- B
Grant the service account the 'Viewer' role on the project.
- C
Grant the service account the 'Storage Object Viewer' role on the bucket.
- D
Grant the service account the 'Storage Admin' role on the bucket.
Show answer and explanation
Correct answer: C
Explanation
To adhere to the principle of least privilege, you should assign the minimum set of permissions necessary for the task. In this scenario, the 'Storage Object Viewer' role grants the service account the ability to read objects within the specified Cloud Storage bucket without granting additional, unnecessary permissions.
- A. Incorrect.
The 'Editor' role includes permissions to modify resources, which is beyond what is needed for reading files from Cloud Storage.
- B. Incorrect.
The 'Viewer' role allows viewing resources within the project but does not specifically grant permissions to read objects from a Cloud Storage bucket.
- C. Correct.
The 'Storage Object Viewer' role is the least privileged role that allows reading objects in a Cloud Storage bucket.
- D. Incorrect.
The 'Storage Admin' role includes permissions to modify storage buckets and their contents, which exceeds the requirements for simply reading files.