Google Associate Cloud Engineer Question 369
Select 3Google Cloud PlatformYour company has a Google Cloud project where a Compute Engine VM needs to access a specific bucket in Cloud Storage. To enhance security, you decide to use service account impersonation instead of directly assigning roles to the VM's service account. Which of the following steps should you take to enable service account impersonation correctly?
- A
Create a new service account with the required permissions for Cloud Storage and allow the VM's service account to impersonate it.
- B
Assign the 'roles/iam.serviceAccountTokenCreator' role to the VM's service account for the newly created service account.
- C
Enable the Cloud Storage API for the project.
- D
Assign the 'roles/storage.objectViewer' role directly to the VM's service account.
- E
Use gcloud command with --impersonate-service-account flag to access the Cloud Storage bucket.
Show answer and explanation
Correct answers: A, B, E
Explanation
To implement service account impersonation, you need to create a service account with the necessary permissions and configure the VM's service account to impersonate it by assigning the 'roles/iam.serviceAccountTokenCreator' role. This setup allows secure, temporary access to resources without directly granting permissions to the VM's service account. Utilizing the gcloud command with the --impersonate-service-account flag enables operations as the impersonated service account, providing an additional security layer.
- A. Correct.
This is necessary to ensure that the VM's service account can impersonate another service account with the required permissions.
- B. Correct.
The 'roles/iam.serviceAccountTokenCreator' role allows the VM's service account to generate access tokens for the impersonated service account.
- C. Incorrect.
While enabling APIs is generally necessary, it is not specific to setting up service account impersonation.
- D. Incorrect.
Assigning roles directly to the VM's service account goes against the goal of using impersonation to limit direct permissions.
- E. Correct.
Using the gcloud command with --impersonate-service-account allows you to perform actions as the impersonated account, aligning with the use case.