Introduction

In this hands-on lab, we are going to demonstrate working with legacy scopes using the default Compute Engine service account on Google Compute Engine.

Solution

Begin by logging in to the GCP Console in an incognito (or other private browser window).

Right click on the Chrome Browser and choose New Incognito Window.

Copy/paste the bucket ID we will be using

1. Click the three bars in the top-left to open the menu and click on IAM & admin.
2. Verify that the Compute Engine default service account member has the Editor Role.

3. Open the top-left menu and select Storage.
4. Highlight the Name of the bucket that ends with scope-lab and copy it to another notepad.

First instance – Read Only Storage scope

Create a Compute Engine instance with a Read Only service account scope, and attempt to copy a file to it.

1. Navigate to the Compute Engine section, using the menu in the top-left of the page.
2. Click Create.
3. In the Identity and API access section:
   • Access scopes: Set access for each API
   • Storage: Read Only
4. Click Create

5. After about 30 seconds, the Compute Engine instance will show in the VM instances list.

6. Click SSH under the Connect section.
7. View the Google Cloud SDK configuration: gcloud config list
8. Attempt to read contents of the Cloud Storage bucket:
9. Note: Be sure to replace BUCKET_NAME with the bucket name we copied in Step 1.
   gsutil ls gs://BUCKET_NAME

10. Attempt to write a file to the same Cloud Storage bucket (this operation will fail). Creating the file will work, but copying it over will not.

touch file1

gsutil cp file1 gs://BUCKET_NAME

11. Close the SSH session tab. exit

Second instance – Read Write Storage scope

In your second instance, attempt to copy a file to the cloud storage bucket. It should succeed.

1. Click CREATE INSTANCE.
2. In the Identity and API access section:
   • Access scopes: Set access for each API
   • Storage: Read Write
3. Click Create

4. After about 30 seconds, the Compute Engine instance will show in the VM instances list.

5. Click SSH under the Connect section.
6. Attempt to read contents of the Cloud Storage bucket:
   Note: Be sure to replace BUCKET_NAME with the bucket name we copied in Step 1.

gsutil ls gs://BUCKET_NAME

7. Attempt to write a file to the same Cloud Storage bucket (this copy operation should now succeed).

touch file1

gsutil cp file1 gs://BUCKET_NAME

8. Close the SSH session tab.exit

9. Now Go to the Cloud storage bucket, you will see the “file1” there.

Happy Learning !!!