Google Professional Cloud Security Engineer Question 108
Single answerGoogle Cloud PlatformYour company is developing a new application on Google Cloud that will leverage Cloud Storage to store sensitive customer data. The application will use Compute Engine instances to process this data. You are tasked with ensuring that only authorized Compute Engine instances can access the Cloud Storage bucket. What is the most appropriate way to implement this authorization control while following the principle of least privilege?
- A
Assign the Storage Object Admin role to the Compute Engine service account at the project level.
- B
Assign the Storage Object Viewer role to the Compute Engine service account at the bucket level.
- C
Enable the default Compute Engine service account and rely on implicit permissions.
- D
Use a custom IAM role with the necessary permissions and assign it to the Compute Engine service account at the bucket level.
Show answer and explanation
Correct answer: D
Explanation
The principle of least privilege emphasizes granting only the permissions necessary for a specific task. In this scenario, using a custom IAM role enables you to define the exact permissions the Compute Engine service account needs to access the Cloud Storage bucket without granting excessive access. Assigning the custom role at the bucket level ensures that the permissions are scoped appropriately and do not apply to other resources unnecessarily, thereby enhancing security.
- A. Incorrect.
This option assigns excessive permissions to the Compute Engine service account and violates the principle of least privilege. The Storage Object Admin role allows full access to all objects in the bucket, including creating, deleting, and modifying them, which is unnecessary for this use case.
- B. Incorrect.
This option is closer to the principle of least privilege but is still not ideal. While the Storage Object Viewer role grants read-only access to the objects in the bucket, it might not align with the specific permissions the application requires, and it uses a predefined role rather than a custom role tailored to the application's needs.
- C. Incorrect.
This option is incorrect because relying on the default Compute Engine service account and its implicit permissions can lead to over-provisioning of access rights. It is not a secure or recommended practice.
- D. Correct.
This is the correct option. Creating a custom IAM role allows you to define the exact permissions needed (e.g., storage.objects.get and storage.objects.list) and assign it specifically to the Compute Engine service account at the bucket level. This approach adheres to the principle of least privilege and provides precise control over access.