You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should y

The correct answer is C. Create a service account and add it to the IAM role `storage.objectCreator' for that bucket.. The question ask us to grant write object permission. You should not give a more broader permission as asked because it's against the principle of least privilege. objectCreator has this description: Allows users to create objects. Does not give permission to view, delete, or rep

Submitted by parkjh· Mar 30, 2026Configuring access and security

Question

You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should you do?

Options

ACreate a service account with an access scope.
BCreate a service account with an access scope.
CCreate a service account and add it to the IAM role `storage.objectCreator' for that bucket.
DCreate a service account and add it to the IAM role `storage.objectAdmin' for that bucket.

How the community answered

(49 responses)

A
2% (1)
B
12% (6)
C
82% (40)
D
4% (2)

Explanation

The question ask us to grant write object permission. You should not give a more broader permission as asked because it's against the principle of least privilege. objectCreator has this description: Allows users to create objects. Does not give permission to view, delete, or replace objects. objectAdmin has this description: Grants full control over objects, including listing, creating, viewing, and deleting objects. The objectAdmin has unnecessary permissions that doesn't needed by the question context. https://cloud.google.com/storage/docs/access-control/iam-roles

Topics

#service accounts#IAM roles#Cloud Storage#least privilege

Community Discussion

No community discussion yet for this question.

Full ASSOCIATE-CLOUD-ENGINEER Practice