Exam Professional Cloud DevOps Engineer topic 1 question 155 discussion

Agree with D

this is regarding the permission, hence providing the correct role will resolve this

To resolve that issue, you should ensure that the Cloud Build service account has the necessary permissions to access the Cloud Storage bucket used for storing Terraform state. The recommended practice is to grant the roles/storage.objectAdmin Identity and Access Management (IAM) role to the Cloud Build service account on the state file bucket. Therefore, the correct answer is (option D) This permission grants the necessary access for Cloud Build to read and write objects (which include Terraform state files) in the specified Cloud Storage bucket, resolving the 403 error. It's important to follow the principle of least privilege and only grant the permissions needed for the specific task at hand.

Vote D

https://cloud.google.com/storage/docs/access-control/iam-roles

Think it's D since the 403 error occurred while the tf actions queries state file in bucket, you only need the object admin permission(state file ). Storage Object Admin (roles/storage.objectAdmin) Grants full control over objects, including listing, creating, viewing, and deleting objects, as well as setting object ACLs. Also grants access to create, delete, get, and list managed folders.

Answer D seems to be correct.