Question

A developer needs to deploy a Compute Engine instance that runs as an existing service account named app-runtime@project.iam.gserviceaccount.com. When they attempt the deployment, it fails with a permissions error even though they have the Compute Instance Admin role. What IAM role must you grant the developer to allow them to attach and deploy resources that run as this service account, following least privilege?

Accepted Answer

Grant the developer the Service Account User (roles/iam.serviceAccountUser) role on the app-runtime service account.

Answer

Grant the developer the Service Account Admin (roles/iam.serviceAccountAdmin) role at the project level.

Answer

Grant the developer the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role on the service account.

Answer

Grant the developer the Owner (roles/owner) role on the project.