Custom IAM Role for Start, Stop, Reset VM Permissions
You manage IAM policies for your organization’s Google Cloud project. A new operations team needs the capability to start, stop, and reset existing Compute Engine VM instances within this project for basic troubleshooting. Due to strict security requirements, the operations team must be prevented from deleting any instances or modifying any networking or configuration settings. You need to grant the minimum necessary permissions to the team members. What should you do?
Community Insight
The question tests least-privilege IAM design on Compute Engine; the trap is reaching for a broad predefined role (like compute.instanceAdmin.v1) and trying to strip away the unwanted permissions with a condition, when only a custom role grants exactly the required permissions.
This Google Cloud IAM scenario tests how to grant least-privilege access to Compute Engine instance lifecycle actions while blocking deletion and configuration changes. The correct approach is a custom IAM role containing only compute.instances.start, compute.instances.stop, and compute.instances.reset, assigned to the operations team at the project level.
The most tempting wrong answer is B: compute.instanceAdmin.v1 with an IAM condition excluding compute.instances.delete. Even with delete blocked, this role still grants dozens of other instance-administration permissions (such as setting metadata, service accounts, and machine types), violating the minimum-necessary requirement. Option A also fails because roles/writer is not a valid Google Cloud IAM role.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is the textbook least-privilege solution: a custom IAM role defined with only compute.instances.start, compute.instances.stop, and compute.instances.reset. A custom role is the only mechanism that lets you include exactly the permissions needed for basic troubleshooting with no excess. The role can be created at project or organization level and granted to the operations team's group, and no IAM condition is required because the role's permission set already excludes deletion and networking or configuration changes.
Why the Other Options Are Wrong
Option B is wrong because roles/compute.instanceAdmin.v1 is a broad predefined role; excluding compute.instances.delete via an IAM condition still leaves many powerful permissions (for example, updating instances, attaching disks, changing service accounts), which violates the strict security requirement. Option A is invalid because roles/writer is not an existing Google Cloud IAM role, and a resource-type condition on a nonexistent role cannot grant instance lifecycle permissions. Option D fails because roles/compute.viewer grants only read-only permissions — a viewer cannot start, stop, or reset an instance, and those Console basic actions require lifecycle permissions the role does not provide.
Community Comment Notes
The single community comment agrees with this verdict, stating: "C (Create a custom IAM role that includes only the compute.instances.start, compute.instances.stop, and compute.instances.reset permissions...)". No dissenting comments were posted, so the learner community and the least-privilege doctrine both point to the custom-role answer.
Official Reference
Exam Strategy
When a question says "minimum necessary" or "least privilege" and lists a narrow set of specific permissions, the answer is almost always a custom IAM role — predefined roles and permission-deny conditions rarely achieve true least privilege. Ignore any option that names an IAM role that does not actually exist, such as roles/writer.
Frequently Asked Questions
Why is compute.instanceAdmin.v1 with a delete-exclusion condition not least privilege?
That predefined role still grants many other instance-administration permissions, such as updating configuration and attaching disks. Only a custom role limits access to exactly the three required lifecycle actions.
Can the operations team start, stop, or reset VMs with roles/compute.viewer?
No. compute.viewer is read-only; instance lifecycle actions require compute.instances.start, stop, and reset permissions, which a viewer role does not include.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →