Which IAM permission allows a user to power on a VM instance that is currently stopped?
Show answer and explanation
Answer: D
compute.instances.start permits powering on an existing Compute Engine instance that is currently stopped. It is distinct from create, which makes a new instance, and from delete, which removes one. Operators who only need to bring stopped machines back online can be granted this permission alone, for example through a custom role.
Why the other options are wrong
- A. compute.instances.create allows making new VM instances. It does not let a user power on an existing stopped instance, so it is the wrong permission here.
- B. compute.instances.setMetadata changes instance metadata such as startup scripts and SSH keys. It does not power a machine on, so it cannot solve this problem.
- C. compute.instances.delete removes an instance entirely, which is the opposite of starting one. Granting it would be a destructive over-permission for an operator.