Google Professional Cloud Security Engineer Question 39
Single answerGoogle Cloud PlatformYour organization uses multiple Google Cloud services, and you have been tasked with securing access to these services for different applications. One of your applications requires access to a Cloud Storage bucket and BigQuery dataset. The application is deployed on Compute Engine instances. What is the best approach to manage the service account for this application while adhering to the principle of least privilege?
- A
Assign the Compute Engine default service account to the instances with Editor role at the project level.
- B
Create a custom service account, grant it only the necessary roles for Cloud Storage and BigQuery, and attach it to the Compute Engine instances.
- C
Use the Compute Engine default service account and assign it roles/storage.admin and roles/bigquery.dataOwner roles.
- D
Create a custom service account, assign it the Owner role, and attach it to the Compute Engine instances.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege requires granting only the permissions necessary for a specific task. Creating a custom service account and assigning specific roles for Cloud Storage and BigQuery ensures that the application has the exact permissions it needs without over-provisioning. This approach also avoids the risks associated with using the Compute Engine default service account, which often has broad permissions by default.
- A. Incorrect.
Assigning the Compute Engine default service account with Editor role at the project level violates the principle of least privilege, as it grants excessive permissions beyond what is necessary for the application.
- B. Correct.
Creating a custom service account with only the required roles for Cloud Storage and BigQuery adheres to the principle of least privilege. This ensures the application has the minimum permissions needed to function correctly.
- C. Incorrect.
Using the Compute Engine default service account with roles/storage.admin and roles/bigquery.dataOwner grants broad permissions, which may exceed what the application actually requires, violating the principle of least privilege.
- D. Incorrect.
Assigning the Owner role to a custom service account gives it full control over the project, which is highly excessive and does not comply with the principle of least privilege.