A system integrator is configuring a Shared VPC. The Host Project contains the VPC, and the Service Project contains the Compute Engine VMs. The VMs…

To allow a Compute Engine VM to access a resource, two distinct actions are required: identity and permission. First, the VM must be assigned an identity by attaching a service account (SA). The question specifies using a custom SA from the Service Project. Second, that identity must be granted the appropriate permissions on the target resource. In this case, the resource is a Cloud Storage bucket in the Host Project. Following the principle of least privilege, the Storage Object Viewer role should be granted directly on the bucket, providing the necessary read-only access without granting excessive permissions.

B. This is incorrect because the requirement is to use a custom Service Account, not the default Compute Engine Service Account.

C. This is incorrect because the Project Editor role is overly permissive, granting broad modification rights to all resources in the Host Project, which violates the principle of least privilege.

D. This is incorrect because the Storage Object Admin role is likely excessive for simple access, and granting any role at the project level is less secure than granting it on the specific bucket.

1. Google Cloud Documentation, "Service accounts overview": A virtual machine (VM) instance uses its attached service account to make authorized API calls. The documentation states, "When you attach a service account to a resource, you give any code that runs on that resource the service account's identity." This supports the first step in option A: attaching the custom SA to the VM.

Source: https://cloud.google.com/iam/docs/service-accounts#attachingaserviceaccounttoaresource

2. Google Cloud Documentation, "IAM roles for Cloud Storage": This document details the predefined roles for Cloud Storage. The roles/storage.objectViewer role grants permissions to view objects and their metadata, which aligns with the requirement to "access" storage and follows the principle of least privilege.

Source: https://cloud.google.com/storage/docs/access-control/iam-roles, Section: "Predefined roles".

3. Google Cloud Documentation, "Granting roles to service accounts for specific resources": This guide explicitly recommends granting roles on specific resources rather than parent resources like projects. "This is the recommended approach because it follows the security principle of least privilege." This directly supports granting the role on the Host Project's bucket, not the entire Host Project.

Source: https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#grant-role-to-sa-for-resource

4. Google Cloud Documentation, "Shared VPC": The Shared VPC documentation clarifies that IAM permissions are managed separately from network configuration. "IAM policies on resources in service projects can grant permission to identities from other projects... For example, a service account in a service project can be granted the Storage Admin role on a Cloud Storage bucket in the host project." This confirms the validity of the cross-project IAM binding described in option A.

Source: https://cloud.google.com/vpc/docs/shared-vpc, Section: "IAM".