Google Professional Cloud DevOps Engineer Question 11
Single answerGoogle Cloud PlatformYou are managing a Google Cloud project for a company that uses multiple microservices. One of the services running on Google Kubernetes Engine (GKE) requires access to a Google Cloud Storage bucket to read and write logs. To follow the principle of least privilege and ensure secure access, how should you configure the service account?
- A
Assign the 'Storage Admin' role to the default Compute Engine service account.
- B
Create a new service account and assign it the 'Storage Object Admin' role, then configure the GKE workload to use this service account.
- C
Use the default App Engine service account and assign it the 'Storage Admin' role.
- D
Create a new service account and assign it the 'Storage Admin' role, then configure the GKE workload to use this service account.
Show answer and explanation
Correct answer: B
Explanation
In this scenario, it is important to follow the principle of least privilege by granting only the permissions required for the workload to function. The 'Storage Object Admin' role allows the workload to manage objects within the specific bucket without granting broader permissions like managing buckets. Creating a dedicated service account for the GKE workload ensures clear separation of responsibilities and security. Configuring the workload to use this service account ensures that the right identity with appropriate permissions is used.
- A. Incorrect.
Assigning the 'Storage Admin' role to the default Compute Engine service account is not recommended because it grants excessive permissions and violates the principle of least privilege.
- B. Correct.
Creating a new service account and assigning the 'Storage Object Admin' role ensures that the workload has only the necessary permissions to read and write objects in the bucket, adhering to the principle of least privilege. Configuring the GKE workload to use this service account ensures secure access.
- C. Incorrect.
The default App Engine service account is not suitable for this scenario as it is not designed for GKE workloads, and assigning it the 'Storage Admin' role still grants excessive permissions.
- D. Incorrect.
While creating a new service account is a good practice, assigning the 'Storage Admin' role gives more permissions than are needed (e.g., the ability to manage buckets), violating the principle of least privilege.