Google Associate Cloud Engineer Question 363
Single answerGoogle Cloud PlatformYou are managing a Google Cloud environment and need to ensure that a Compute Engine instance can write logs to Cloud Logging using its service account. Which IAM role should you grant to the service account to fulfill this requirement?
- A
roles/logging.logWriter
- B
roles/editor
- C
roles/viewer
- D
roles/logging.viewer
Show answer and explanation
Correct answer: A
Explanation
For a Compute Engine instance to write logs to Cloud Logging using its service account, the role 'roles/logging.logWriter' is the appropriate choice. It specifically grants permissions to write log entries, thereby following the principle of least privilege by granting only the necessary permissions needed for the task.
- A. Correct.
The 'roles/logging.logWriter' role grants the necessary permissions for writing logs to Cloud Logging, which is exactly what is required in this scenario.
- B. Incorrect.
The 'roles/editor' role provides broad permissions across all Google Cloud services, which is more than needed for just writing logs and not a best practice for least privilege.
- C. Incorrect.
The 'roles/viewer' role only allows read access to resources, which would not allow the service account to write logs.
- D. Incorrect.
The 'roles/logging.viewer' role allows viewing logs, not writing them, making it unsuitable for this requirement.