Grundlegende Sicherheitsfunktionen in Google Cloud implementieren: Challenge Lab Rezensionen

直 大. · Vor 11 Tage überprüft

Akash Y. · Vor 11 Tage überprüft

Mala P. · Vor 11 Tage überprüft

Mala P. · Vor 11 Tage überprüft

Angelo M. · Vor 11 Tage überprüft

Padmaraj B. · Vor 11 Tage überprüft

kaori i. · Vor 11 Tage überprüft

Pratik K. · Vor 11 Tage überprüft

Andre J. · Vor 11 Tage überprüft

Ainur H. · Vor 11 Tage überprüft

Ismael Z. · Vor 11 Tage überprüft

Jadson L. · Vor 11 Tage überprüft

Sida Z. · Vor 11 Tage überprüft

Mohamed Laroussi G. · Vor 11 Tage überprüft

S Y A. · Vor 11 Tage überprüft

Akshaya S. · Vor 11 Tage überprüft

karol z. · Vor 11 Tage überprüft

Good

Sumit K. · Vor 11 Tage überprüft

Lamgok Hando S. · Vor 11 Tage überprüft

Robert B. · Vor 11 Tage überprüft

Alisa G. · Vor 11 Tage überprüft

Meenakshi R. · Vor 11 Tage überprüft

facing this error AI Mode conversation: student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ gcloud iam roles create $CUSTOM_ROLE --project=$PROJECT_ID --file=role-definition.yaml ERROR: (gcloud.iam.roles.create) [student-01-df988ffb7b72@qwiklabs.net] does not have permission to access projects instance [qwiklabs-gcp-02-13d48424c66f] (or it may not exist): You don't have permission to create a role in projects/qwiklabs-gcp-02-13d48424c66f. This command is authenticated as student-01-df988ffb7b72@qwiklabs.net which is the active account specified by the [core/account] property. - '@type': type.googleapis.com/google.rpc.ErrorInfo domain: iam.googleapis.com metadata: error_info_id: CiQwMWExNzg5Ni00ZDFkLTdkZGItOTU2MS1mYTk0YWJhMTVhZjkSJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY= permission: iam.roles.create resource: projects/qwiklabs-gcp-02-13d48424c66f troubleshooter_url: https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWExNzg5Ni00ZDFkLTdkZGItOTU2MS1mYTk0YWJhMTVhZjkSJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY%3D reason: IAM_PERMISSION_DENIED AI Mode reply for student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ gcloud iam roles create $CUSTOM_ROLE --project=$PROJECT_ID --file=role-definition.yaml ERROR: (gcloud.iam.roles.create) [student-01-df988ffb7b72@qwiklabs.net] does not have permission to access projects instance [qwiklabs-gcp-02-13d48424c66f] (or it may not exist): You don't have permission to create a role in projects/qwiklabs-gcp-02-13d48424c66f. This command is authenticated as student-01-df988ffb7b72@qwiklabs.net which is the active account specified by the [core/account] property. - '@type': type.googleapis.com/google.rpc.ErrorInfo domain: iam.googleapis.com metadata: error_info_id: CiQwMWExNzg5Ni00ZDFkLTdkZGItOTU2MS1mYTk0YWJhMTVhZjkSJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY= permission: iam.roles.create resource: projects/qwiklabs-gcp-02-13d48424c66f troubleshooter_url: https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWExNzg5Ni00ZDFkLTdkZGItOTU2MS1mYTk0YWJhMTVhZjkSJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY%3D reason: IAM_PERMISSION_DENIED The error occurs because your active student account (student-01-df988ffb7b72@qwiklabs.net) lacks the iam.roles.create permission required to create custom IAM roles in that Google Cloud project. In Qwiklabs environments, permissions are strictly limited based on the specific lab instructions. If creating a custom role is part of your current lab, you are likely running into one of the following common sandbox issues: How to Fix This • Check your active project ID: Verify that the $PROJECT_ID variable points exactly to the project assigned to you for this lab session. Run gcloud config get-value project to verify. • Review the Lab Instructions: Qwiklabs frequently provides two different student accounts (e.g., Student 1 and Student 2). Double-check if the lab instructed you to perform this specific step using a different account or service account that has higher privileges (like Role Administrator or Owner). • Reset the Lab: If you are certain you are using the correct account and following the steps exactly, the Qwiklabs backend may have failed to provision your account's permissions properly. End the lab, start a fresh instance, and try again. Are you following a specific Qwiklabs / Google Cloud Skills Boost lab? If so, please share the name of the lab or the previous step you ran so we can find the exact account or command you should be using. AI can make mistakes, so double-check responses "Implement Cloud Security Fundamentals on Google Cloud: Challenge Lab" Task 1. Create a custom security role AI Mode reply for "Implement Cloud Security Fundamentals on Google Cloud: Challenge Lab" Task 1. Create a custom security role To complete Task 1: Create a custom security role in the Implement Cloud Security Fundamentals on Google Cloud: Challenge Lab (GSP342), you need to create a project-level custom IAM role that provides specific Google Cloud Storage (GCS) permissions. Quick Implementation via Cloud Shell 1. Open Cloud Shell in your Google Cloud Console. 2. Define the exact Custom Role Name provided to you in your lab instructions by running the export command (replace orca_storage_editor_xyz with your exact lab string if different):bash export CUSTOM_ROLE="orca_storage_editor_xyz" Use code with caution. 3. Run the following command to create the custom role inline with the required storage permissions:bash gcloud iam roles create $CUSTOM_ROLE \ --project=$DEVSHELL_PROJECT_ID \ --title="Orca Storage Editor" \ --description="Custom role for challenge lab storage access" \ --permissions="storage.buckets.get,storage.objects.get,storage.objects.list,storage.objects.update,storage.objects.create" \ --stage="ALPHA" Use code with caution. Alternative Implementation (YAML Method) If you prefer configuring via a file definition, execute this block in Cloud Shell: bash # 1. Create the definition file cat <<EOF > role-definition.yaml title: "Orca Storage Editor" description: "Custom role for challenge lab storage access" stage: "ALPHA" includedPermissions: - storage.buckets.get - storage.objects.get - storage.objects.list - storage.objects.update - storage.objects.create EOF # 2. Create the role using the YAML file gcloud iam roles create $CUSTOM_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yaml Use code with caution. Architectural Reasoning • Principle of Least Privilege: By bundling only the specific storage.* permissions required to view buckets and manipulate objects, you avoid using pre-baked roles like roles/storage.admin which expose destructive permissions (such as deleting entire buckets). • Scope Definition: Creating the role with --project restricts its availability strictly to this workspace container rather than an entire organization node. Would you like the commands for Task 2 (Create a service account) and Task 3 (Bind the role to the service account) to continue with the lab setup? • Medium·Puy P Implement Cloud Security Fundamentals on Google Cloud Challenge scenario You have started a new role as a junior member of the security team for the Orca team in Jooli Inc. Your team i... • Medium·Ugochukwu Ukwuegbu Implement Cloud Security Fundamentals on Google Cloud 6 Jan 2026 — Implement Cloud Security Fundamentals on Google Cloud: Challenge Lab (GSP342) Solution The challenge To deploy, configure, and tes... • Pradeep Gadde Implement Cloud Security Fundamentals on Google Cloud Your challenge As this compute instance is not in the same subnet as the private cluster you must make sure that the master author... Show all You said: student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ # 1. Create the definition filecat <<EOF > role-definition.yamltitle: "Orca Storage Editor"description: "Custom role for challenge lab storage access"stage: "ALPHA"includedPermissions: - storage.buckets.get - storage.objects.get - storage.objects.list - storage.objects.update - storage.objects.createEOF# 2. Create the role using the YAML filegcloud iam roles create $CUSTOM_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yamlERROR: (gcloud.iam.roles.create) [student-01-df988ffb7b72@qwiklabs.net] does not have permission to access projects instance [qwiklabs-gcp-02-13d48424c66f] (or it may not exist): You don't have permission to create a role in projects/qwiklabs-gcp-02-13d48424c66f. This command is authenticated as student-01-df988ffb7b72@qwiklabs.net which is the active account specified by the [core/account] property.- '@type': type.googleapis.com/google.rpc.ErrorInfo domain: iam.googleapis.com metadata: error_info_id: CiQwMWExNzg5ZC01ZWI0LTdlMDMtYmEzNy02N2NmYTk3Mzg1NzASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY= permission: iam.roles.create resource: projects/qwiklabs-gcp-02-13d48424c66f troubleshooter_url: https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWExNzg5ZC01ZWI0LTdlMDMtYmEzNy02N2NmYTk3Mzg1NzASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY%3D reason: IAM_PERMISSION_DENIED student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ # 1. Create the definition filecat <<EOF > role-definition.yamltitle: "Orca Storage Editor"description: "Custom role for challenge lab storage access"stage: "ALPHA"includedPermissions: - storage.buckets.get - storage.objects.get - storage.objects.list - storage.objects.update - storage.objects.createEOF# 2. Create the role using the YAML filegcloud iam roles create $CUSTOM_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yamlERROR: (gcloud.iam.roles.create) [student-01-df988ffb7b72@qwiklabs.net] does not have permission to access projects instance [qwiklabs-gcp-02-13d48424c66f] (or it may not exist): You don't have permission to create a role in projects/qwiklabs-gcp-02-13d48424c66f. This command is authenticated as student-01-df988ffb7b72@qwiklabs.net which is the active account specified by the [core/account] property.- '@type': type.googleapis.com/google.rpc.ErrorInfo domain: iam.googleapis.com metadata: error_info_id: CiQwMWExNzg5ZC01ZWI0LTdlMDMtYmEzNy02N2NmYTk3Mzg1NzASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY= permission: iam.roles.create resource: projects/qwiklabs-gcp-02-13d48424c66f troubleshooter_url: https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWExNzg5ZC01ZWI0LTdlMDMtYmEzNy02N2NmYTk3Mzg1NzASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY%3D reason: IAM_PERMISSION_DENIED AI Mode reply for student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ # 1. Create the definition file cat <<EOF > role-definition.yaml title: "Orca Storage Editor" description: "Custom role for challenge lab storage access" stage: "ALPHA" includedPermissions: - storage.buckets.get - storage.objects.get - storage.objects.list - storage.objects.update - storage.objects.create EOF # 2. Create the role using the YAML file gcloud iam roles create $CUSTOM_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yaml ERROR: (gcloud.iam.roles.create) [student-01-df988ffb7b72@qwiklabs.net] does not have permission to access projects instance [qwiklabs-gcp-02-13d48424c66f] (or it may not exist): You don't have permission to create a role in projects/qwiklabs-gcp-02-13d48424c66f. This command is authenticated as student-01-df988ffb7b72@qwiklabs.net which is the active account specified by the [core/account] property. - '@type': type.googleapis.com/google.rpc.ErrorInfo domain: iam.googleapis.com metadata: error_info_id: CiQwMWExNzg5ZC01ZWI0LTdlMDMtYmEzNy02N2NmYTk3Mzg1NzASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY= permission: iam.roles.create resource: projects/qwiklabs-gcp-02-13d48424c66f troubleshooter_url: https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWExNzg5ZC01ZWI0LTdlMDMtYmEzNy02N2NmYTk3Mzg1NzASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY%3D reason: IAM_PERMISSION_DENIED The IAM_PERMISSION_DENIED error occurred because the environment variable $CUSTOM_ROLE was empty when you ran the command. When it evaluated to nothing, gcloud attempted to look up organization-level resources or project instances it shouldn't modify, triggering a permissions error. To fix this immediately, you must declare the exact custom role name from your lab instructions page. The Fix Run these commands in your Cloud Shell sequentially: 1. Set the environment variable (Replace orca_storage_editor_123 with the exact Custom Role name listed in your specific Qwiklabs/Google Cloud Skills Boost instructions page):bash export CUSTOM_ROLE="orca_storage_editor_123" Use code with caution. 2. Run the creation command again:bash gcloud iam roles create $CUSTOM_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yaml Use code with caution. The role will now create successfully at the project level. Let me know if you hit any roadblocks, or tell me the name of your Service Account and GKE Cluster so we can knock out Tasks 2 and 3 next! • Google Cloud Documentation gcloud iam roles create | Google Cloud SDK This command creates a custom role with the provided information. You must also specify the --organization or --project flag. • Medium·Puy P Implement Cloud Security Fundamentals on Google Cloud Task 1. Create a custom security role 0. 2. Set values from the lab. 3. Create a yaml file defining the permissions. Create the cu... gcloud iam roles create $CUSTOM_SECURITY_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yaml AI Mode reply for gcloud iam roles create $CUSTOM_SECURITY_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yaml The error occurs because the environment variable you used this time—$CUSTOM_SECURITY_ROLE—is still unassigned or empty in your current Cloud Shell session. When gcloud evaluates an empty variable, it tries to parse --project as the role name instead, causing the command to fail. Run this sequence of commands to set your variable correctly and create the role: 1. Set the role variable Check your exact lab instructions page for the required role identifier (it usually looks like orca_storage_editor_xxx or orca_storage_update). Run the export command with that exact name: bash export CUSTOM_SECURITY_ROLE="orca_storage_editor_xyz" Use code with caution. (Replace orca_storage_editor_xyz with your exact string from the lab details). 2. Verify the variable is set bash echo $CUSTOM_SECURITY_ROLE Use code with caution. Make sure it outputs your role name and isn't blank. 3. Create the role Now, execute your deployment command again: bash gcloud iam roles create $CUSTOM_SECURITY_ROLE --project=$DEVSHELL_PROJECT_ID --file=role-definition.yaml Use code with caution. Once executed, it should show a success output containing the description and permissions list. Did the role create successfully this time? If you are ready for Task 2, tell me the required Service Account name from your instructions and we can build the creation command! • Medium·Mr. Ånand Ensure Access & Identity in Google Cloud: Challenge Lab | by Mr. Ånand You can also try these steps to create a custom security role: 1. Create a custom security role … 2. Save the role 3. Create the r... • LinkedIn·Christopher Howell GCP Security: IAM - Part 1 Creating Custom Roles List available permissions that can be applied to a resource - you can use the following gcloud command to g... • Google Cloud Documentation gcloud iam roles create | Google Cloud SDK This command creates a custom role with the provided information. You must also specify the --organization or --project flag. proj... Show all student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ gcloud iam roles create $SERVICE_ACCOUNT --display-name "Orca Private Cluster Service Account" ERROR: (gcloud.iam.roles.create) unrecognized arguments: --display-name Orca Private Cluster Service Account To search the help text of gcloud commands, run: gcloud help -- SEARCH_TERMS AI Mode reply for student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ gcloud iam roles create $SERVICE_ACCOUNT --display-name "Orca Private Cluster Service Account" ERROR: (gcloud.iam.roles.create) unrecognized arguments: --display-name Orca Private Cluster Service Account To search the help text of gcloud commands, run: gcloud help -- SEARCH_TERMS The error occurred because you are using the gcloud iam roles create command, but you are trying to provide service account arguments (--display-name). To create a Service Account (instead of a role), you need to use the gcloud iam service-accounts create command. The Solution Run these commands in your Cloud Shell to set up the service account for Task 2: 1. Set your service account variable (Check your lab manual for the exact required ID, usually orca-private-cluster-sa or similar):bash export SERVICE_ACCOUNT="orca-private-cluster-sa" Use code with caution. 2. Create the Service Account:bash gcloud iam service-accounts create $SERVICE_ACCOUNT \ --display-name="Orca Private Cluster Service Account" Use code with caution. What's Next? (Task 3: Bind the Custom Role) Once the service account is successfully created, you will need to bind the custom role you made in Task 1 to this service account using the following command layout: bash gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \ --member="serviceAccount:$SERVICE_ACCOUNT@$DEVSHELL_PROJECT_://gserviceaccount.com" \ --role="projects/$DEVSHELL_PROJECT_ID/roles/$CUSTOM_SECURITY_ROLE" Use code with caution. (Make sure $CUSTOM_SECURITY_ROLE is set to your Task 1 role ID before running this). Did the service account creation go through? Let me know if you need the exact syntax to deploy the GKE Cluster or Logging/Monitoring parts of the lab next! AI Mode reply for student_01_df988ffb7b72@cloudshell:~ (qwiklabs-gcp-02-13d48424c66f)$ gcloud iam service-accounts create $SERVICE_ACCOUNT --display-name "Orca Private Cluster Service Account" ERROR: (gcloud.iam.service-accounts.create) [student-01-df988ffb7b72@qwiklabs.net] does not have permission to access projects instance [qwiklabs-gcp-02-13d48424c66f] (or it may not exist): Permission 'iam.serviceAccounts.create' denied on resource '//cloudresourcemanager.googleapis.com/projects/qwiklabs-gcp-02-13d48424c66f' (or it may not exist). Remediate access with this Troubleshooter URL or share it with your administrator - https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWExNzhhZS0xNjZmLTcxOTMtOGQwYy04OTYxNjc5YWVkOTASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY%3D . This command is authenticated as student-01-df988ffb7b72@qwiklabs.net which is the active account specified by the [core/account] property. - '@type': type.googleapis.com/google.rpc.ErrorInfo domain: iam.googleapis.com metadata: error_info_id: CiQwMWExNzhhZS0xNjZmLTcxOTMtOGQwYy04OTYxNjc5YWVkOTASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY= permission: iam.serviceAccounts.create resource: projects/qwiklabs-gcp-02-13d48424c66f troubleshooter_url: https://console.cloud.google.com/iam-admin/troubleshooter/summary;errorId=CiQwMWExNzhhZS0xNjZmLTcxOTMtOGQwYy04OTYxNjc5YWVkOTASJXByb2plY3RzL3F3aWtsYWJzLWdjcC0wMi0xM2Q0ODQyNGM2NmY%3D reason: IAM_PERMISSION_DENIED The IAM_PERMISSION_DENIED error is happening because the environment variable $SERVICE_ACCOUNT is completely empty in your current Cloud Shell session. When you execute the command with a blank variable, gcloud misinterprets the structural arguments, causing a permission fallback error.

Sarika P. · Vor 12 Tage überprüft

Andrei K. · Vor 12 Tage überprüft

Juan Esteban D. · Vor 12 Tage überprüft