Google Associate Cloud Engineer Question 368
Select 2Google Cloud PlatformYou are tasked with setting up a Google Cloud environment where a Compute Engine VM needs to access a Cloud Storage bucket. To adhere to the principle of least privilege, you decide to use service account impersonation. Which of the following steps are necessary to correctly configure service account impersonation in this scenario?
- A
Create a new service account for the VM and grant it the 'Storage Object Viewer' role.
- B
Assign the 'Service Account Token Creator' role on the service account to the VM's default service account.
- C
Enable the IAM API to allow service account impersonation.
- D
Grant the VM's service account the 'roles/iam.serviceAccountUser' role on the target service account.
Show answer and explanation
Correct answers: B, D
Explanation
To set up service account impersonation, it is necessary to allow the VM's service account to act as the target service account. This can be achieved by assigning the 'Service Account Token Creator' role to the VM's service account on the target service account. Additionally, the 'roles/iam.serviceAccountUser' role must be granted to enable the VM's service account to use the target service account. These configurations ensure that the VM can securely access the Cloud Storage bucket by impersonating the service account with the appropriate permissions.
- A. Incorrect.
This option involves creating a service account and granting it a specific role, but it does not address service account impersonation.
- B. Correct.
The 'Service Account Token Creator' role allows a service account to generate access tokens that can be used to impersonate another service account, which is essential for service account impersonation.
- C. Incorrect.
Enabling the IAM API is generally necessary for managing IAM resources, but it is not specifically required for setting up service account impersonation.
- D. Correct.
The 'roles/iam.serviceAccountUser' role allows a user or service account to act as the service account being impersonated, which is a crucial step in configuring service account impersonation.