Custom IAM Role for Start, Stop, Reset VM Permissions

ACE By islever Editorial Last updated Oct 24, 2026

Managing Identity and Access Management (IAM).

Short answer

C Create a custom IAM role granting only compute.instances.start, compute.instances.stop, and compute.instances.reset to the operations team on the project.

Question

You manage IAM policies for your organization’s Google Cloud project. A new operations team needs the capability to start, stop, and reset existing Compute Engine VM instances within this project for basic troubleshooting. Due to strict security requirements, the operations team must be prevented from deleting any instances or modifying any networking or configuration settings. You need to grant the minimum necessary permissions to the team members. What should you do?

Grant the operations team the roles/writer IAM role, and add the resource.type =='compute.googleapis.com/Instance' condition to the role.
Grant the operations team the predefined roles/compute.instanceAdmin.v1 IAM role on the project. Apply an IAM condition to exclude the compute.instances.delete permission.
Create a custom IAM role that includes only the compute.instances.start, compute.instances.stop, and compute.instances.reset permissions. Assign this role to the operations team on the project. Correct Answer
Grant the operations team the predefined roles/compute.viewer IAM role to allow them to view the instances. Instruct them to use the Google Cloud Console’s basic actions such as starting, stopping, and resetting.

Key Takeaways

The question tests least-privilege IAM design on Compute Engine; the trap is reaching for a broad predefined role (like compute.instanceAdmin.v1) and trying to strip away the unwanted permissions with a condition, when only a custom role grants exactly the required permissions.

This Google Cloud IAM scenario tests how to grant least-privilege access to Compute Engine instance lifecycle actions while blocking deletion and configuration changes. The correct approach is a custom IAM role containing only compute.instances.start, compute.instances.stop, and compute.instances.reset, assigned to the operations team at the project level.

Common mistake: The most tempting wrong answer is B: compute.instanceAdmin.v1 with an IAM condition excluding compute.instances.delete. Even with delete blocked, this role still grants dozens of other instance-administration permissions (such as setting metadata, service accounts, and machine types), violating the minimum-necessary requirement. Option A also fails because roles/writer is not a valid Google Cloud IAM role.

Expert Analysis

Why the Answer Is Correct

Option C is the textbook least-privilege solution: a custom IAM role defined with only compute.instances.start, compute.instances.stop, and compute.instances.reset. A custom role is the only mechanism that lets you include exactly the permissions needed for basic troubleshooting with no excess. The role can be created at project or organization level and granted to the operations team's group, and no IAM condition is required because the role's permission set already excludes deletion and networking or configuration changes.

Why the Other Options Are Wrong

Option B is wrong because roles/compute.instanceAdmin.v1 is a broad predefined role; excluding compute.instances.delete via an IAM condition still leaves many powerful permissions (for example, updating instances, attaching disks, changing service accounts), which violates the strict security requirement. Option A is invalid because roles/writer is not an existing Google Cloud IAM role, and a resource-type condition on a nonexistent role cannot grant instance lifecycle permissions. Option D fails because roles/compute.viewer grants only read-only permissions — a viewer cannot start, stop, or reset an instance, and those Console basic actions require lifecycle permissions the role does not provide.

Community Comment Notes

The single community comment agrees with this verdict, stating: "C (Create a custom IAM role that includes only the compute.instances.start, compute.instances.stop, and compute.instances.reset permissions...)". No dissenting comments were posted, so the learner community and the least-privilege doctrine both point to the custom-role answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question says "minimum necessary" or "least privilege" and lists a narrow set of specific permissions, the answer is almost always a custom IAM role — predefined roles and permission-deny conditions rarely achieve true least privilege. Ignore any option that names an IAM role that does not actually exist, such as roles/writer.

Frequently Asked Questions

Why is compute.instanceAdmin.v1 with a delete-exclusion condition not least privilege?

That predefined role still grants many other instance-administration permissions, such as updating configuration and attaching disks. Only a custom role limits access to exactly the three required lifecycle actions.

Can the operations team start, stop, or reset VMs with roles/compute.viewer?

No. compute.viewer is read-only; instance lifecycle actions require compute.instances.start, stop, and reset permissions, which a viewer role does not include.

More ACE FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

Mr_MIXER007 👍 1 Answered C

C (Create a custom IAM role that includes only the compute.instances.start, compute.instances.stop, and compute.instances.reset permissions...)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All ACE Questions

Access 84 questions with complete answers and detailed explanations.

View Full ACE Practice Test →

← Back to ACE Study Guide