Your team sets up a Shared VPC Network where project co-vpc-prod is the host project.
Your team has configured the firewall rules, subnets, and VPN gateway on the host project.
They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?
Click on the arrows to vote for the correct answer
A. B. C. D.C.
https://cloud.google.com/vpc/docs/shared-vpcTo enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet in the Shared VPC Network, your team needs to grant them the appropriate permissions.
Option A: Compute Network User Role at the host project level This role grants permission to create and manage VM instances within the host project's network. However, it does not provide granular control over subnets within the network. Therefore, this option does not meet the requirement.
Option B: Compute Network User Role at the subnet level This role provides permissions to create and manage VM instances within a specific subnet. However, it does not provide access to the Shared VPC Network, which is required to create a VM instance within the network. Therefore, this option does not meet the requirement.
Option C: Compute Shared VPC Admin Role at the host project level This role grants permission to manage the Shared VPC Network and all its associated resources within the host project. It allows Engineering Group A to create and manage VM instances within the network, as well as manage subnets and firewall rules. However, this role provides more permissions than necessary to meet the requirement, as it grants access to manage the entire Shared VPC Network. Therefore, this option is not the most appropriate solution.
Option D: Compute Shared VPC Admin Role at the service project level This role grants permission to create and manage VM instances within a service project connected to the Shared VPC Network. By granting this role at the service project level, Engineering Group A can create and manage VM instances within the 10.1.1.0/24 subnet while being restricted from other subnets and resources in the network. This option meets the requirement while providing granular control over the specific subnet that Engineering Group A needs access to.
Therefore, the correct answer is D: Compute Shared VPC Admin Role at the service project level.