Google Associate Cloud Engineer Question 357
Single answerGoogle Cloud PlatformYou are deploying a new application on Google Kubernetes Engine (GKE) that requires access to Cloud Storage buckets to store logs. To adhere to the principle of least privilege, how should you configure access using service accounts?
- A
Assign the default Compute Engine service account to the GKE nodes and grant it Storage Admin role.
- B
Create a new service account, grant it the Storage Object Creator role, and assign it to the GKE nodes.
- C
Assign the default GKE service account to the nodes and grant it Storage Admin role.
- D
Create a new service account, grant it the Storage Object Creator role, and assign it to the application pods.
Show answer and explanation
Correct answer: D
Explanation
The principle of least privilege dictates that you should grant the minimum level of access necessary for a task. By creating a new service account with the specific Storage Object Creator role and assigning it to the application pods, you ensure that only the application has access to write logs to Cloud Storage, minimizing potential security risks.
- A. Incorrect.
Assigning the default Compute Engine service account with wide privileges to GKE nodes can lead to excessive permissions, violating the principle of least privilege.
- B. Incorrect.
Granting the Storage Object Creator role to a new service account is a step in the right direction, but assigning it to the nodes rather than the application pods can still provide more access than necessary.
- C. Incorrect.
Assigning the default GKE service account with Storage Admin role grants excessive permissions, not adhering to the principle of least privilege.
- D. Correct.
Creating a new service account with only the necessary Storage Object Creator role and assigning it directly to the application pods ensures that only the application has the needed access, adhering to the principle of least privilege.