A customer wants to grant access to their application running on Compute Engine to write only to a specific Cloud Storage bucket. How should you grant access?

Question

Options

• ACreate a service account for the application, and grant Cloud Storage Object Creator permissions
• BCreate a service account for the application, and grant Cloud Storage Object Creator permissions
• CCreate a user account, authenticate with the application, and grant Google Storage Admin
• DCreate a user account, authenticate with the application, and grant Google Storage Admin

• A
  3% (2)
• B
  73% (47)
• C
  9% (6)
• D
  14% (9)

Explanation

A is not correct because it doesn't restrict the scope to specific bucket. B is correct because it provides the right permissions and keeps the scope limited to the bucket in C is not correct because using a user account goes against the recommended best practice as it should be a machine/service account that should be handling the writing to bucket. D is not correct because using a user account goes against the recommended best practice as it should be a machine/service account that should be handling the writing to bucket and it also widens the scope to storage wide which violates minimum required privilege rules. https://cloud.google.com/iam/docs/understanding-service- accounts#using_service_accounts_with_compute_engine

No community discussion yet for this question.