Free Preparation Discussions
MENU
Google Professional Cloud Security Engineer Exam - Topic 4 Question 110 Discussion
Topic #: 4
A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?
To provide temporary write access to a Cloud Storage bucket with the minimum permissions necessary, you should:
Identify the Compute Engine instance's default service account: Each Compute Engine instance has a default service account that is used to interact with other Google Cloud services.
Assign the storage.objectCreator role: This predefined IAM role grants permissions to create objects in a Cloud Storage bucket, which is sufficient for temporary write access. It does not grant permissions to read or delete objects, thus adhering to the principle of least privilege.
Avoid using full permissions or long-lived keys: Options A and C suggest using broader permissions than necessary or embedding long-lived keys, which could pose a security risk if compromised.
Service account impersonation (Option D)is not necessary for this task and would be more appropriate for scenarios where you need to assume a different identity with different permissions.
Joana
9 hours agoThad
6 days agoCarissa
11 days agoTwila
16 days agoRoxane
21 days agoDalene
26 days agoJesusa
1 month agoLuther
1 month agoYuriko
1 month agoTricia
2 months agoDacia
2 months agoAltha
2 months agoReita
2 months agoElke
2 months agoFlorinda
3 months agoHubert
3 months agoJina
3 months agoBernardine
2 months agoQueenie
3 months ago