Associate Cloud Engineer free question 9 / 10 · Domain 4: Configuring access and security
You want to create service accounts together in one dedicated project and attach them to VMs in other projects. According to the page on attaching service accounts to resources, which organization policy setting is correct?
- Enforce iam.disableCrossProjectServiceAccountUsage in the project where the VM is created
- Do not enforce iam.disableCrossProjectServiceAccountUsage in the project where the VM is created
- Do not enforce iam.disableCrossProjectServiceAccountUsage at the organization node and let projects inherit it
- Do not enforce iam.disableCrossProjectServiceAccountUsage in the project that contains the service accounts
Show the answer and explanation
Answer: D
Why this is correct
The page says that to let a service account in one project be attached to a resource in another project, you need to adjust the organization policy for the project that contains the service account. One of the constraints to check is iam.disableCrossProjectServiceAccountUsage, and you confirm that it is not enforced. This constraint controls attachment across projects, is enforced by default, and can be set only at the project level.
Why the other options are wrong
"Do not enforce iam.disableCrossProjectServiceAccountUsage at the organization node and let projects inherit it" … The page says this constraint can be set only at the project level, and not at the folder or organization level.
"Do not enforce iam.disableCrossProjectServiceAccountUsage in the project where the VM is created" … The organization policy to adjust is the one on the project that contains the service account, not on the project where the resource is created.
"Enforce iam.disableCrossProjectServiceAccountUsage in the project where the VM is created" … The page says to adjust the organization policy of the project that contains the service accounts. Also, when this constraint is enforced it prevents attaching a service account to resources in other projects, so enforcing it does the opposite of the goal.
Supplement
For attachment across projects, there is also a step that grants Service Account Token Creator on the service account to the service agent of the service that owns the resource. The page strongly advises against reverting after you enable it, especially in production, because resources may stop working correctly.
Go to the Associate Cloud Engineer practice app (10 free questions; purchase unlocks all questions)