Free Preparation Discussions
MENU
Google Professional Cloud Security Engineer Exam - Topic 4 Question 110 Discussion
Topic #: 4
A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?
To provide temporary write access to a Cloud Storage bucket with the minimum permissions necessary, you should:
Identify the Compute Engine instance's default service account: Each Compute Engine instance has a default service account that is used to interact with other Google Cloud services.
Assign the storage.objectCreator role: This predefined IAM role grants permissions to create objects in a Cloud Storage bucket, which is sufficient for temporary write access. It does not grant permissions to read or delete objects, thus adhering to the principle of least privilege.
Avoid using full permissions or long-lived keys: Options A and C suggest using broader permissions than necessary or embedding long-lived keys, which could pose a security risk if compromised.
Service account impersonation (Option D)is not necessary for this task and would be more appropriate for scenarios where you need to assume a different identity with different permissions.
Deonna
7 days agoCiara
12 days agoLaurene
17 days agoRemedios
22 days agoTammi
27 days agoNenita
1 month agoMiriam
1 month agoJoana
2 months agoThad
2 months agoCarissa
2 months agoTwila
2 months agoRoxane
3 months agoDalene
3 months agoJesusa
3 months agoLuther
3 months agoYuriko
3 months agoTricia
3 months agoDacia
4 months agoAltha
4 months agoReita
4 months agoElke
4 months agoFlorinda
5 months agoHubert
5 months agoJina
5 months agoDean
2 days agoBernardine
4 months agoQueenie
5 months ago