You are implementing security best practices on your data pipeline. Currently, you are manually executing jobs as the Project Owner. You want to automate these jobs by taking nightly batch files…

Question

Options

• ARestrict the Google Cloud Storage bucket so only you can see the files
• BGrant the Project Owner role to a service account, and run the job with it
• CUse a service account with the ability to read the batch files and to write to BigQuery
• DUse a user account with the Project Viewer role on the Cloud Dataproc cluster to read the batch files and write to BigQuery

• A
  6% (1)
• B
  18% (3)
• C
  71% (12)
• D
  6% (1)

Explanation

Option C follows the principle of least privilege - a service account should have only the permissions it needs to do its job (read from GCS, write to BigQuery), and nothing more. A is wrong because restricting visibility to yourself doesn't solve the automation problem and keeps the workload tied to a personal account. B is wrong because granting Project Owner to a service account is massively over-privileged - if that account is compromised, the attacker owns the entire project. D is wrong because a user account should never be used for automated workloads, and Project Viewer is read-only so it couldn't write to BigQuery anyway.

Memory tip: Think "robot worker" - service accounts are for machines, user accounts are for humans. The robot should carry only the keys it needs for that specific job, not a master keyring for the whole building.

No community discussion yet for this question.