Google Associate Cloud Engineer Question 358
Select 2Google Cloud PlatformYou are setting up a Google Cloud environment where a Compute Engine instance needs to access data stored in a Cloud Storage bucket. To accomplish this, you decide to use a service account to grant the necessary permissions. Which of the following steps should you take to correctly assign the service account to the Compute Engine instance?
- A
A. Create a service account and assign the 'Storage Admin' role to it.
- B
B. Attach the service account to the Compute Engine instance at instance creation or by updating the instance settings.
- C
C. Enable the Cloud Storage API in the Google Cloud project.
- D
D. Store the service account's key file on the Compute Engine instance and use it to authenticate.
- E
E. Assign the 'Compute Admin' role to the service account.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure a Compute Engine instance can access a Cloud Storage bucket using a service account, you need to create a service account with the necessary permissions and attach it to the instance. The 'Storage Admin' role allows access to Cloud Storage, and attaching the service account to the instance ensures it can authenticate securely through the metadata server without the need for a key file.
- A. Correct.
A. Correct step: Creating a service account and assigning an appropriate role, such as 'Storage Admin', grants the necessary permissions for accessing Cloud Storage.
- B. Correct.
B. Correct step: Attaching the service account to the Compute Engine instance allows the instance to use the service account's permissions to access resources.
- C. Incorrect.
C. While enabling the Cloud Storage API is necessary for API interactions, it is not directly related to assigning a service account to a resource.
- D. Incorrect.
D. Storing the service account's key file on the instance is not recommended due to security risks. Instead, use the Compute Engine metadata server for authentication.
- E. Incorrect.
E. Assigning the 'Compute Admin' role is unnecessary for accessing Cloud Storage and could grant excessive permissions.