Question

A contractor needs temporary read access to a Compute Engine project only until the end of the current month. Your security team requires that the access automatically expire without any manual cleanup, and they want to avoid creating a custom role. What is the best way to grant this access?

Accepted Answer

Grant the contractor the roles/compute.viewer role with an IAM condition that uses request.time to expire the binding at the end of the month

Answer

Grant the contractor the roles/compute.viewer role and set a calendar reminder to remove the binding manually at month-end

Answer

Create a service account key for the contractor and delete the key at the end of the month

Answer

Add the contractor to a Google Group that is granted roles/compute.viewer, then delete the group next month