Question

An application runs on a Compute Engine VM in project 'app-prod' using a dedicated service account. The application must read objects from a Cloud Storage bucket that lives in a separate project called 'data-shared'. You want to grant the minimum access required following Google-recommended practices. What should you do?

Accepted Answer

In the 'data-shared' project, grant the VM's service account (from 'app-prod') the roles/storage.objectViewer role on the bucket.

Answer

Download a service-account key for the VM's service account and store it in the 'data-shared' project's Secret Manager.

Answer

Grant the VM's service account the roles/owner role on the 'data-shared' project.

Answer

Recreate the bucket inside 'app-prod' so the service account has access by default.