PCSE roles/iam.serviceAccountUser Practice Question
A security engineer needs to grant a team the ability to impersonate a service account (SA) in project B from a Compute Engine instance in project A. The SA in project B has the required permissions to access Cloud Storage. What IAM configuration is required?
⚠ Common exam trap
A common mistake in Google Cloud is confusing roles/iam.serviceAccountUser (allows impersonation) with roles/iam.serviceAccountTokenCreator (generates tokens but doesn't grant impersonation). For cross-project impersonation, you need both the impersonator's SA to have serviceAccountUser on the target SA and the target SA to have the necessary resource permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the instance's service account the roles/iam.serviceAccountUser role on the SA in project B, and grant the SA in project B roles/storage.objectViewer.
It combines two necessary steps: first, the instance's service account in project A needs the roles/iam.serviceAccountUser role on the target service account in project B to gain impersonation privileges; second, the target service account in project B must have roles/storage.objectViewer to access Cloud Storage. Without both, the impersonation would either fail (no permission to use the target SA) or the target SA would lack the storage access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant the instance's service account the roles/iam.serviceAccountUser role on the SA in project B, and grant the SA in project B roles/storage.objectViewer.
Why this is correct
roles/iam.serviceAccountUser includes the 'actAs' permission. This allows the instance to impersonate the target SA, which already has the storage role.
- ✗
Grant the instance's service account the roles/iam.serviceAccountTokenCreator role on the SA in project B.
Why it's wrong here
roles/iam.serviceAccountTokenCreator allows creating tokens but not impersonation. The correct role is serviceAccountUser (actAs).
- ✗
Create a new service account in project A with the necessary storage permissions and use that.
Why it's wrong here
This does not use the SA in project B. The requirement is to impersonate the specific SA in project B.
- ✗
Grant the instance's service account the roles/storage.objectViewer role directly.
Why it's wrong here
This would give the instance direct access, but the requirement is to impersonate the SA in project B. Also, the instance might not have permission to access resources across projects.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.