Google Associate Cloud Engineer Question 362
Select 2Google Cloud PlatformYou are managing a Google Cloud project and need to ensure that a specific service account can only access the necessary resources for a new application deployed on Google Cloud Platform. The service account should have read access to a Cloud Storage bucket and should be able to publish messages to a Pub/Sub topic. Which IAM roles should you assign to this service account?
- A
roles/storage.objectViewer on the Cloud Storage bucket
- B
roles/storage.objectAdmin on the Cloud Storage bucket
- C
roles/pubsub.publisher on the Pub/Sub topic
- D
roles/pubsub.viewer on the Pub/Sub topic
- E
roles/storage.admin on the Cloud Storage bucket
Show answer and explanation
Correct answers: A, C
Explanation
To adhere to the principle of least privilege, the service account should be assigned roles that grant only the necessary permissions. 'roles/storage.objectViewer' provides the required read access to the Cloud Storage bucket, and 'roles/pubsub.publisher' allows publishing messages to the Pub/Sub topic. Other roles either provide excessive permissions or do not meet the specified requirements.
- A. Correct.
This role grants read access to the objects in the Cloud Storage bucket, which aligns with the requirement.
- B. Incorrect.
This role grants full access to manage objects in the Cloud Storage bucket, which exceeds the requirement of read access only.
- C. Correct.
This role allows the service account to publish messages to the Pub/Sub topic, satisfying the requirement.
- D. Incorrect.
This role grants read access to view messages and topics, but not to publish messages, which does not meet the requirement.
- E. Incorrect.
This role grants full administrative access to Cloud Storage, which is more than necessary for the read-only requirement.