Google Associate Cloud EngineerSetting up a cloud solution environmentHard
A new Cloud Engineer is setting up their local development environment for Google Cloud. They have successfully installed the Cloud SDK and authenticated their account using 'gcloud auth login'. However, when they try to list resources, they encounter 'ERROR: (gcloud.compute.instances.list) PERMISSION_DENIED: Required 'compute.instances.list' permission for 'projects/[PROJECT_ID]'. What is the most likely missing configuration step?
- AThe Cloud SDK installation is corrupted and needs to be reinstalled.
- BThey haven't set a default project using 'gcloud config set project [PROJECT_ID]'.
- CThe authenticated user account lacks the necessary IAM role to list Compute Engine instances in that project.
- DThey need to run 'gcloud components update' to get the latest components.
Show answer & explanationAnswer & explanation
Correct answer: C. The authenticated user account lacks the necessary IAM role to list Compute Engine instances in that project.
The error message `PERMISSION_DENIED: Required 'compute.instances.list' permission` explicitly indicates that the authenticated user account does not have the necessary IAM permissions (roles) to perform the requested action (listing Compute Engine instances) within the specified project. This is a common IAM issue.
Why the other options are wrong
- A. A corrupted installation would likely result in different errors, such as commands not being found, not a specific permission denied message.
- B. While setting a default project is important for convenience, the error message clearly states 'projects/[PROJECT_ID]', implying a project was either set or inferred, and the issue is permission, not project context.
- D. Updating components is good practice but won't resolve a permission denied error.
GCP IAM Permission Denied
A 'PERMISSION_DENIED' error in Google Cloud indicates that the authenticated principal (user, service account) lacks the necessary IAM permissions to perform a requested action on a specific resource.
- Requires assigning appropriate IAM roles.
- Permissions are granted via roles.
- Errors often specify the missing permission (e.g., `compute.instances.list`).
Memory trick: If the cloud says 'no', check your key (IAM).