Google Associate Cloud Engineer Question 356
Single answerGoogle Cloud PlatformYou have a Compute Engine instance that needs to access data stored in Google Cloud Storage. Which of the following actions should you take to ensure the instance has the proper permissions to access the storage bucket while following best practices?
- A
Assign the 'Editor' role to the Compute Engine instance
- B
Create a new service account, grant it the 'Storage Object Viewer' role on the bucket, and attach the service account to the instance
- C
Use the default Compute Engine service account and grant it the 'Storage Admin' role on the bucket
- D
Add the instance's machine email directly to the bucket's ACL with 'Reader' access
Show answer and explanation
Correct answer: B
Explanation
The best practice for assigning permissions in Google Cloud is to use service accounts with specific roles that grant only the necessary permissions. By creating a new service account and assigning it the 'Storage Object Viewer' role, you're ensuring that the instance has the exact permissions it needs without over-provisioning, thus adhering to the principle of least privilege.
- A. Incorrect.
Assigning the 'Editor' role gives overly broad permissions, which is not a best practice as it violates the principle of least privilege.
- B. Correct.
Creating a new service account and granting it the 'Storage Object Viewer' role provides the necessary permissions while adhering to the principle of least privilege, and is considered a best practice.
- C. Incorrect.
Using the default Compute Engine service account might work, but assigning the 'Storage Admin' role is too permissive for simple read access.
- D. Incorrect.
Adding the instance's machine email to the bucket's ACL directly is not recommended as it can lead to difficult-to-manage permissions and does not follow the principle of least privilege.