A security reviewer flags a production web tier for running as the project's default compute identity. What is the core concern with this setup?
Show answer and explanation
Answer: C
The default account's broad project-level role grants more access than a web tier should hold. If an instance is compromised, an attacker inherits those permissions across many services. The remedy is a dedicated service account with only the roles the application needs, attached to the VM, so the blast radius stays small and access is easy to audit.
Why the other options are wrong
- A. Service accounts carry no hourly charge, so cost is not the concern. The risk is about the permissions the identity holds.
- B. The default account is not limited to containers, and attaching it to a VM is allowed. The problem is the scope of its permissions, not where it can run.
- D. The default account can authenticate to Google Cloud APIs. Its role bindings determine what it can do, and those bindings are broad, so the issue is excess access.