Question

A financial services company runs a production project in Google Cloud. During a scheduled quarterly maintenance window, a contractor named Dana needs the ability to restart Compute Engine instances, but only for a 48-hour period this weekend. Company policy mandates least privilege and prohibits granting standing access to contractors. Dana already has a Cloud Identity account. What is the most appropriate way to grant this access?

Accepted Answer

Add an IAM binding granting Dana the roles/compute.instanceAdmin.v1 role with an IAM Condition that limits the grant to the specific date/time range of the maintenance window.

Answer

Grant Dana the roles/compute.instanceAdmin.v1 role at the project level and remove the binding manually after the maintenance window ends.

Answer

Create a service account with roles/compute.instanceAdmin.v1, generate a key, and give the key to Dana for the duration of the window.

Answer

Grant Dana the roles/owner role temporarily so she can restart the instances and revoke it after the weekend.