You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should…

The correct answer is C. Create a service account and add it to the IAM role `storage.objectCreator' for that bucket. The question ask us to grant write object permission. You should not give a more broader permission as asked because it's against the principle of least privilege. objectCreator has this description: Allows users to create objects. Does not give permission to view, delete, or…

Submitted by parkjh· Mar 30, 2026Configuring access and security

Question

You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should you do?

Options

ACreate a service account with an access scope.
BCreate a service account with an access scope.
CCreate a service account and add it to the IAM role `storage.objectCreator' for that bucket.
DCreate a service account and add it to the IAM role `storage.objectAdmin' for that bucket.

How the community answered

(49 responses)

A
2% (1)
B
12% (6)
C
82% (40)
D
4% (2)

Explanation

The question ask us to grant write object permission. You should not give a more broader permission as asked because it's against the principle of least privilege. objectCreator has this description: Allows users to create objects. Does not give permission to view, delete, or replace objects. objectAdmin has this description: Grants full control over objects, including listing, creating, viewing, and deleting objects. The objectAdmin has unnecessary permissions that doesn't needed by the question context. https://cloud.google.com/storage/docs/access-control/iam-roles

Topics

#service accounts#IAM roles#Cloud Storage#least privilege

Community Discussion

No community discussion yet for this question.

Full ASSOCIATE-CLOUD-ENGINEER Practice