Your team is configuring a Compute Engine VM that will only read objects from a single Cloud Storage bucket. The VM runs under a new user-managed service account. To follow the principle of least privilege, which IAM grant should you create?
Grant the project's default Compute Engine service account the Owner role on the project.
Grant the service account the Storage Admin role on the project.
Grant the service account the Editor role on the project.
Grant the service account the Storage Object Viewer role on the bucket.
The Storage Object Viewer role (roles/storage.objectViewer) contains just the permissions needed to list and read objects, and nothing more. Granting it on the specific bucket limits the scope of access to exactly the required resource. The Editor and Storage Admin roles include many additional permissions across the entire project, violating least-privilege guidance. Giving the project's default Compute Engine service account Owner access is both overly broad and applied to the wrong principal.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the principle of least privilege and why is it important for IAM roles?
Open an interactive chat with Bash
What is a user-managed service account and how does it differ from default service accounts?
Open an interactive chat with Bash
What permissions does the Storage Object Viewer role grant?
Open an interactive chat with Bash
What is the principle of least privilege in IAM?
Open an interactive chat with Bash
What does the Storage Object Viewer role do in Google Cloud?
Open an interactive chat with Bash
Why is it recommended to use user-managed service accounts for Compute Engine instead of default service accounts?
Open an interactive chat with Bash
GCP Associate Cloud Engineer
Configuring access and security
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
Pass with Confidence.
IT & Cybersecurity Package
You have hit the limits of our free tier, become a Premium Member today for unlimited access.
Military, Healthcare worker, Gov. employee or Teacher? See if you qualify for a Community Discount.
Monthly
$19.99 $11.99
$11.99/mo
Billed monthly, Cancel any time.
$19.99 after promotion ends
3 Month Pass
$44.99 $26.99
$8.99/mo
One time purchase of $26.99, Does not auto-renew.
$44.99 after promotion ends
Save $18!
MOST POPULAR
Annual Pass
$119.99 $71.99
$5.99/mo
One time purchase of $71.99, Does not auto-renew.
$119.99 after promotion ends
Save $48!
BEST DEAL
Lifetime Pass
$189.99 $113.99
One time purchase, Good for life.
Save $76!
What You Get
All IT & Cybersecurity Package plans include the following perks and exams .