Google Professional Cloud Network Engineer Question 40
Select 2Google Cloud PlatformYou are designing a Shared VPC architecture in Google Cloud for your organization. The host project contains a set of subnets that will be shared with two service projects. You need to ensure that the network administrators in the service projects can create and manage VM instances in the subnets but cannot modify the subnets themselves. Which IAM roles should you assign to the network administrators in the service projects?
- A
roles/compute.networkUser on the host project
- B
roles/compute.networkAdmin on the host project
- C
roles/compute.instanceAdmin.v1 on the service projects
- D
roles/compute.securityAdmin on the host project
- E
roles/iam.serviceAccountUser on the service projects
Show answer and explanation
Correct answers: A, C
Explanation
In a Shared VPC architecture, service project administrators need permissions to use the shared subnets from the host project and to create resources like VM instances. The 'roles/compute.networkUser' role allows them to utilize the shared subnets without granting excessive permissions to modify or manage the network configuration. Additionally, the 'roles/compute.instanceAdmin.v1' role is required for creating and managing VM instances in the service projects. This setup adheres to the principle of least privilege, ensuring administrators have only the permissions necessary for their tasks.
- A. Correct.
Correct. The 'roles/compute.networkUser' role grants permissions to use the shared subnets from the host project without allowing modifications to the subnets. This is required for the service project administrators to create resources like VMs in the shared subnets.
- B. Incorrect.
Incorrect. The 'roles/compute.networkAdmin' role allows full control over network resources, including the ability to modify subnets. This exceeds the required permissions and does not meet the principle of least privilege.
- C. Correct.
Correct. The 'roles/compute.instanceAdmin.v1' role allows administrators to create and manage VM instances, which is necessary for their tasks within the service projects.
- D. Incorrect.
Incorrect. The 'roles/compute.securityAdmin' role is used for managing firewall rules and SSL certificates. This is not relevant to the given scenario where the goal is to create and manage VM instances in shared subnets.
- E. Incorrect.
Incorrect. The 'roles/iam.serviceAccountUser' role is needed when users need access to manage or use service accounts. While this role is common in VM creation, it is not directly relevant to the primary focus of the scenario, which is managing access to the network.