Google Professional Cloud Security Engineer Question 53
Single answerGoogle Cloud PlatformYou are designing a Google Cloud-based application that consists of a Compute Engine instance running a web server and a Cloud Storage bucket to store user-uploaded files. The web server needs to upload files to the Cloud Storage bucket. What is the best way to grant the web server appropriate permissions to perform this task?
- A
Manually generate OAuth 2.0 tokens and embed them in the application code to access the Cloud Storage bucket.
- B
Use the Compute Engine default service account and assign it the ‘Storage Object Admin’ role.
- C
Create a custom service account with the ‘Storage Object Admin’ role and assign it to the Compute Engine instance.
- D
Use user credentials and API keys stored in a configuration file on the Compute Engine instance to access the Cloud Storage bucket.
Show answer and explanation
Correct answer: C
Explanation
In Google Cloud, service accounts are the recommended way to authenticate and authorize interactions between services. By creating a custom service account with the specific permissions required (e.g., ‘Storage Object Admin’ role) and assigning it to the Compute Engine instance, you ensure adherence to the principle of least privilege and secure access. This avoids the risks associated with hardcoding credentials or using overly permissive default accounts.
- A. Incorrect.
Manually generating and embedding OAuth 2.0 tokens in code is insecure and does not align with best practices for managing access in Google Cloud.
- B. Incorrect.
The Compute Engine default service account has broad permissions by default, which may violate the principle of least privilege and could lead to excessive access.
- C. Correct.
Creating a custom service account with the ‘Storage Object Admin’ role aligns with the principle of least privilege and provides secure, scoped access for the Compute Engine instance to interact with the Cloud Storage bucket.
- D. Incorrect.
Storing user credentials and API keys in a configuration file is insecure, prone to accidental exposure, and violates Google Cloud security best practices.