A VM instance is trying to read from a Cloud Storage bucket. IAM roles assigned to the VM service account allows the VM instance to read from the bucket. But the scopes assigned to the VM deny the reading bucket. What will happen when VM tries to read from the bucket?

Question

Accepted Answer

B. The read will not execute as IAM roles and scopes both determine what operations will be For a VM instance to perform an action on a Google Cloud resource, both the IAM roles assigned to its service account and the access scopes configured for the VM must grant the necessary permissions. If either the IAM role or the access scope denies the action, the operation will fail, as scopes effectively filter down the permissions granted by IAM roles.

Answer

A. The application performing the read will drop the read operation The application will not just drop the read operation; the underlying Google Cloud security mechanisms will explicitly deny it.

Answer

C. The read will succeed because the most permissive permission is allowed The read will not succeed because Google Cloud's security model for VMs is restrictive, requiring both IAM roles and VM access scopes to be permissive for an action to be allowed.

Answer

D. The read operation will execute, but a message will be sent to the Stackdriver Logging While logging might occur, the primary outcome is that the read operation will be denied due to the scope restriction, not that it executes with a log message.

A VM instance is trying to read from a Cloud Storage bucket. IAM roles assigned to the VM service account allows the VM instance to read from the bucket. But the scopes assigned to the VM deny the rea

Question

Options

How the community answered

Why each option

Topics

Community Discussion