Iam Service Account Identity Resource Dual Role

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is configuring access for a new data pipeline in Google Cloud. The deployment involves two projects:

Project A (Compute Project): Hosts Compute Engine instances that run data processing workloads.
Project B (Data Project): Hosts BigQuery datasets containing sensitive analytics data.

Workloads running on Compute Engine in Project A must use a user-managed service account named data-processor@project-a.iam.gserviceaccount.com to read BigQuery data in Project B. A DevOps engineer needs permission to deploy and configure Compute Engine instances in Project A and attach data-processor@project-a.iam.gserviceaccount.com to those instances. The DevOps engineer must not be permitted to attach or impersonate any other service account in Project A, nor access BigQuery data directly with their personal identity.

Which combination of IAM role bindings meets these requirements while enforcing least privilege?

Grant roles/bigquery.dataViewer to serviceAccount:data-processor@project-a.iam.gserviceaccount.com on Project B. Grant roles/compute.instanceAdmin.v1 and roles/iam.serviceAccountUser to the DevOps engineer on Project A.

Grant roles/bigquery.dataViewer to the DevOps engineer on Project B. Grant roles/compute.instanceAdmin.v1 to the DevOps engineer on Project A. Grant roles/iam.serviceAccountUser to serviceAccount:data-processor@project-a.iam.gserviceaccount.com on Project A.

Grant roles/bigquery.dataViewer to serviceAccount:data-processor@project-a.iam.gserviceaccount.com on Project B. Grant roles/compute.instanceAdmin.v1 to the DevOps engineer on Project A. Grant roles/iam.serviceAccountTokenCreator to the DevOps engineer on Project A.

Professional Cloud Security Engineer

Iam Service Account Identity Resource Dual Role

Related questions