PROFESSIONAL-CLOUD-ARCHITECT · Question #184
Case Study: 8 - Mountkirk Games, C Company overview Mountkirk Games makes online, session-based, multiplayer games for mobile platforms. They have recently started expanding to other platforms after…
The correct answer is C. Create a service account (SA) in the legacy game's Google Cloud project, add this SA in the new. Cross-project Cloud Storage access is correctly granted by adding the source project's service account as a principal in the destination project's IAM policy with the appropriate Storage role.
Question
Options
- ACreate a service account (SA) in the legacy game's Google Cloud project, add a second SA in the
- BCreate a service account (SA) in the legacy game's Google Cloud project, give the SA the
- CCreate a service account (SA) in the legacy game's Google Cloud project, add this SA in the new
- DCreate a service account (SA) in the legacy game's Google Cloud project, give it the Firebase
How the community answered
(16 responses)- A19% (3)
- B31% (5)
- C44% (7)
- D6% (1)
Why each option
Cross-project Cloud Storage access is correctly granted by adding the source project's service account as a principal in the destination project's IAM policy with the appropriate Storage role.
Adding a second service account in the new project and trying to link them does not create a valid cross-project IAM binding; each project's SA is independent and cannot delegate permissions to another project's SA this way.
Giving the source project's SA permissions within the same source project does not grant access to resources in the destination (new game's) project.
Creating a service account in the legacy game's project and then adding that SA as a principal in the new game's project IAM policy with the Storage Object Viewer (or equivalent) role follows GCP's recommended cross-project access pattern; the SA authenticates with its own project's credentials while the resource-level IAM binding in the destination project grants the actual access, avoiding key file management and following least-privilege principles.
Firebase Admin SDK roles are application-level roles for Firebase services and are not the correct mechanism for granting cross-project Cloud Storage access between two GKE-based game backends.
Concept tested: Cross-project IAM service account access to Cloud Storage
Source: https://cloud.google.com/iam/docs/best-practices-service-accounts#cross-project
Topics
Community Discussion
No community discussion yet for this question.