Which TWO of the following are valid methods to securely access Google Cloud APIs from a Compute Engine instance without managing service account keys?
Trap 1: Download a service account key file and store it on the instance
Requires managing key files, which is a security risk.
Trap 2: Grant the appropriate IAM roles to the instance's service account
Roles are necessary but not a method of access; they are permissions.
Trap 3: Use a Cloud KMS key to generate temporary credentials
Cloud KMS is for encryption, not generating credentials.
- A
Download a service account key file and store it on the instance
Why wrong: Requires managing key files, which is a security risk.
- B
Attach a custom service account to the instance using the gcloud command
Custom service account can be attached at creation, no keys needed.
- C
Grant the appropriate IAM roles to the instance's service account
Why wrong: Roles are necessary but not a method of access; they are permissions.
- D
Use a Cloud KMS key to generate temporary credentials
Why wrong: Cloud KMS is for encryption, not generating credentials.
- E
Use the default Compute Engine service account
The default service account is automatically attached; access via metadata server.