You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices. What should you do?
A.
Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
B.
Create a custom role with the permission compute.instances.list and grant the Service Account this role.
C.
Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
D.
Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
B. Create a custom role with the permission compute.instances.list and grant the Service Account this role: This follows the principle of least privilege by granting only the specific permission needed.
I don't get why is it not C, you grant that specific service account the role over all instances, is it wrong because that service account will be able to view not only compute instances?
Key here is "and grant the Service Account this role.". C and D are giving this role to ALL instances which is overly permissive. A is wrong. Only choice is B
Compute Viewer
Read-only access to get and list Compute Engine resources, without being able to read the data stored on them.
https://cloud.google.com/compute/docs/access/iam#compute.viewer
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
MohitA
Highly Voted 3 years, 7 months agomlyu
3 years, 7 months agoAzureDP900
1 year, 5 months agosudarchary
Highly Voted 2 years, 3 months agoArizonaClassics
Most Recent 7 months, 2 weeks agoBrosh
1 year, 4 months agoshayke
1 year, 4 months agoMeyucho
1 year, 4 months agoAwesomeGCP
1 year, 6 months agonbrnschwgr
1 year, 8 months agoRoflcopter
1 year, 8 months agocloudprincipal
1 year, 10 months agocloudprincipal
1 year, 10 months agocloudprincipal
1 year, 10 months ago[Removed]
3 years agoDebasishLowes
3 years, 1 month agodtmtor
3 years, 1 month ago[Removed]
3 years, 6 months agogenesis3k
3 years, 6 months ago