Configuring access and security1 / 5
Your application on Compute Engine needs to write data to a Pub/Sub topic and read from Cloud Storage. You want to follow the principle of least privilege. Which approach should you use?
CorrectNot quite
Alex
Google Cloud best practice is to create dedicated service accounts with only the IAM roles needed. For writing to Pub/Sub, assign roles/pubsub.publisher. For reading from Cloud Storage, assign roles/storage.objectViewer. The Editor basic role grants overly broad permissions across all services, violating least privilege. Storing API keys on VMs is insecure and unnecessary when using service accounts. The default Compute Engine service account often has the Editor role, which is too permissive for production. Always create purpose-specific service accounts. Ref: cloud.google.com/iam/docs/best-practices
Sourcecloud.google.com
Create a free account to keep asking Alex — no credit card required.
Question 1 of 5
Get started free