I85PREP
⌘ K
ACE-Associate study materials
ACE-Associate study resources

Shared VPC Onboarding Under a Hard Deadline

ACE-Associate · Put your knowledge to work in context.

All case studies

Shared VPC Onboarding Under a Hard Deadline

Your organization has a host project net-host-prod with a Shared VPC already attached to two service projects. A new analytics team needs its own service project analytics-prod to launch 40 Compute Engine VMs into two subnets of the host VPC. The team's engineers are in a Google Group [email protected]. Security requires that the analytics VMs cannot reach the payments subnet, and that the analytics team cannot create or modify subnets in the host project. The team also wants to use their own service account [email protected] on the VMs. The deadline is in three days and the platform team that owns the host project is on leave.

1. What is the correct sequence of IAM grants to let the analytics team launch VMs into the host VPC while honoring the constraints?

Read the worked answer
  1. On the host project, a host-project admin grants roles/compute.networkUser on the Shared VPC subnet(s) the analytics VMs may use - not on the host project as a whole. Granting at the subnet level is what enforces "cannot touch the payments subnet."
  2. Also on the host project, grant roles/container.hostServiceAgentUser only if GKE is involved (not here).
  3. On the service project analytics-prod, grant roles/compute.instanceAdmin.v1 and roles/iam.serviceAccountUser on etl-runner@... to [email protected] so they can create VMs that run as that SA.
  4. Do not grant roles/compute.networkAdmin or roles/compute.securityAdmin at the host project - that would violate "cannot create or modify subnets."
  5. The subnet-level networkUser grant requires the host-project admin, who is on leave - this is the schedule risk to escalate on day one, not day three.

2. The platform team is unreachable. Can the analytics team self-serve any of these grants, and what is the fastest safe path?

Read the worked answer

No. roles/compute.networkUser on host subnets can only be granted by someone with resourcemanager.projects.setIamPolicy on the host project (or the subnet). Service-project admins cannot grant it to themselves.

Fastest safe path:

  • Escalate to whoever holds roles/owner or roles/resourcemanager.projectIamAdmin on net-host-prod - often a break-glass admin or org admin, not just the platform team.
  • Pre-stage everything the analytics team controls (service project creation, SA creation, instance templates) so the moment the subnet grant lands they can deploy.
  • Do not work around it by giving the analytics team a broad host-project role "temporarily" - that violates the payments-subnet isolation requirement and is hard to unwind.