CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating Service Account Permissions for GCP-ACE
Learn how to efficiently set up service account permissions for Google Cloud functions in this GCP-ACE exam question walkthrough.
You might stumble on questions regarding service account permissions. Candidates often confuse broad roles with specific roles, leading to missteps in the exam. Understanding the principle of least privilege is crucial here.
The question
You need to set up a service account for a Google Cloud function that needs to access BigQuery and Pub/Sub. What is the most efficient way to grant the necessary permissions?
- A. Assign the 'BigQuery User' and 'Pub/Sub Subscriber' roles to the service account.
- B. Create a custom role that includes both permissions and assign it to the service account.
- C. Use the 'Editor' role for the service account to cover all necessary permissions.
- D. Grant the 'BigQuery Admin' and 'Pub/Sub Admin' roles to the service account.
Think before you scroll
Before making your choice, consider the principle of least privilege. The best approach is to assign only the necessary permissions for the service account to perform its tasks without exposing it to unnecessary risks.
The answer
The correct option is A. Assigning the 'BigQuery User' and 'Pub/Sub Subscriber' roles provides exactly what the Cloud Function needs to interact with the required resources. This approach adheres to the principle of least privilege, ensuring the service account has no excess permissions.
Why the other options lose
- B. Create a custom role that includes both permissions and assign it to the service account. While creating a custom role may seem tailored, it adds unnecessary complexity for this scenario. The predefined roles already exist for a reason and fulfill the requirements effectively.
- C. Use the 'Editor' role for the service account to cover all necessary permissions. The 'Editor' role grants broad permissions, exceeding what is necessary. This violates the principle of least privilege and increases security risks.
- D. Grant the 'BigQuery Admin' and 'Pub/Sub Admin' roles to the service account. Similar to option C, this approach assigns excessive permissions. Admin roles provide capabilities far beyond what is required for the Cloud Function, posing security concerns.
The concept behind it
Understanding how to assign roles effectively is a key skill. Always look for the least privilege. This means granting only the permissions necessary for a task, which minimizes potential security threats. Familiarize yourself with predefined roles and their scopes for optimal efficiency.
Exam trap to remember
Remember: always choose the least privilege option. It’s a critical principle in cloud security and a common exam trap that can lead to wrong answers.