Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ107

Configuring access

You are developing an application running on a Compute Engine VM. The application must access data stored in Cloud Storage buckets in other Google Cloud projects. The needed bucket access varies. You need to grant access to these resources while following Google-recommended practices. What should you do?

  • A Limit the VMs access to the Cloud Storage buckets by setting the relevant access scope of the VM.
  • B Create IAM bindings for the VM’s service account and the required buckets that allow appropriate access to the data stored in the buckets.
  • C Grant the VM's service account access to the required buckets by using domain-wide delegation.
  • D Create a group and assign IAM bindings to the group for each bucket that the application needs to access. Assign the VM's service account to the group.
Explanation

Compute Engine best practice is to use the VM's service account and control its access through IAM roles, rather than using restrictive access scopes. Cloud Storage IAM policies can be set on individual buckets, so each bucket can grant that service account only the role and permissions required, including across project boundaries.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!