Question

A Compute Engine VM was created with the default service account and the access scope set to 'Allow default access'. The application on the VM needs to write objects to a Cloud Storage bucket, but writes fail with a permission error even though the service account has been granted the Storage Object Admin IAM role at the project level. What is the most likely cause, and how should you fix it?

Accepted Answer

The default access scope does not include full storage read/write; stop the VM and change its access scope to include the Cloud Platform scope (or a storage-read-write scope), then restart it.

Answer

IAM roles cannot be granted at the project level for storage; re-grant Storage Object Admin directly on the bucket.

Answer

The default service account must be replaced with a user-managed service account before any IAM role takes effect.

Answer

Access scopes are deprecated and ignored; the issue is a missing firewall rule blocking outbound HTTPS to storage.googleapis.com.