Google Associate Cloud Engineer Question 366
Select 2Google Cloud PlatformYou are managing a Google Cloud Platform project and need a Compute Engine instance to write logs to a Cloud Storage bucket using service account impersonation. What steps must you take to correctly configure the necessary permissions?
- A
Grant the Compute Engine instance's service account the roles/iam.serviceAccountUser role on the target service account.
- B
Grant the target service account the roles/storage.objectCreator role on the Cloud Storage bucket.
- C
Grant the Compute Engine instance's service account the roles/storage.admin role on the Cloud Storage bucket.
- D
Grant the target service account the roles/iam.serviceAccountTokenCreator role on the Compute Engine instance's service account.
- E
Grant the Compute Engine instance the roles/compute.instanceAdmin role.
Show answer and explanation
Correct answers: A, B
Explanation
To enable a service account impersonation setup where a Compute Engine instance writes logs to a Cloud Storage bucket, the instance's service account must be allowed to impersonate the target service account. Additionally, the target service account needs the necessary permissions to perform the intended actions on the Cloud Storage bucket. Granting roles/iam.serviceAccountUser on the target account and roles/storage.objectCreator on the bucket ensures that the instance can impersonate the target account and write logs without unnecessary permissions.
- A. Correct.
This step allows the Compute Engine instance's service account to impersonate the target service account, which is necessary for accessing resources using the target account's permissions.
- B. Correct.
This role allows the target service account to create objects in the Cloud Storage bucket, enabling it to write logs.
- C. Incorrect.
Granting the storage.admin role is unnecessary for writing logs and provides excessive permissions that are not aligned with the principle of least privilege.
- D. Incorrect.
This role is not relevant for this scenario. The serviceAccountTokenCreator role is typically used in different contexts, such as generating access tokens.
- E. Incorrect.
The compute.instanceAdmin role is not relevant to service account impersonation or permissions related to Cloud Storage.