Google Associate Cloud Engineer Question 360
Select 2Google Cloud PlatformYou are asked to set up a new service account in your Google Cloud project for an application that will access Cloud Storage and Pub/Sub. To follow the principle of least privilege, which roles should you assign to the service account to ensure it has the necessary permissions without overly broad access?
- A
Storage Object Viewer
- B
Pub/Sub Publisher
- C
Storage Admin
- D
Pub/Sub Admin
- E
Viewer
- F
Storage Object Admin
Show answer and explanation
Correct answers: A, B
Explanation
To adhere to the principle of least privilege, it's crucial to assign the minimum necessary permissions to service accounts. For an application that needs to access Cloud Storage and Pub/Sub, granting 'Storage Object Viewer' allows the service account to read objects in Cloud Storage without the ability to modify or delete them. Similarly, 'Pub/Sub Publisher' permits publishing messages to Pub/Sub topics without the capability to manage the entire service, ensuring the service account has just enough permissions to perform its required tasks.
- A. Correct.
The Storage Object Viewer role allows the service account to read objects in Cloud Storage, which is appropriate if the application only needs to read data.
- B. Correct.
The Pub/Sub Publisher role grants the service account permission to publish messages to Pub/Sub topics, which is necessary if the application needs to send messages.
- C. Incorrect.
The Storage Admin role provides full control over Cloud Storage buckets and objects, which is excessive if the application only needs to read data.
- D. Incorrect.
The Pub/Sub Admin role allows full management of Pub/Sub resources, which is more access than needed if the application only needs to publish messages.
- E. Incorrect.
The Viewer role provides read-only access to all resources in a project, which may grant more access than required for the specific services.
- F. Incorrect.
The Storage Object Admin role allows full control over objects within Cloud Storage, which is more than needed if the application only needs to read objects.