Explanation:
Using a dedicated service account with the narrowest role (pubsub.publisher) attached to the VM follows least privilege. Default service accounts with Editor are overly permissive. Using keys is not recommended, and admin role is too broad.
Ultimate access to all questions.
An application on Compute Engine must publish messages to Pub/Sub. Following least privilege, what do you do?
A
Use the default Compute SA (has Editor)
B
Create a dedicated service account with roles/pubsub.publisher, attach it to the VM
C
Download a key for a Pub/Sub admin SA into the VM
D
Grant roles/pubsub.admin to the VM's SA
No comments yet.