Question

A developer needs to deploy Compute Engine instances that run as an existing service account named app-runtime@project-id.iam.gserviceaccount.com. The developer already holds the Compute Instance Admin (v1) role on the project but receives an error stating they lack permission to act as the service account when they try to attach it to a new VM. Following least privilege, what should the security engineer grant?

Accepted Answer

Grant the developer the Service Account User (roles/iam.serviceAccountUser) role on the app-runtime service account resource

Answer

Grant the developer the Service Account Admin (roles/iam.serviceAccountAdmin) role at the project level

Answer

Grant the developer the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role on the project

Answer

Add the developer as an Owner (roles/owner) on the project so they inherit all service account permissions