ARC134

Overview

In a challenge lab you’re given a scenario and a set of tasks. Instead of following step-by-step instructions, you will use the skills learned from the labs in the course to figure out how to complete the tasks on your own! An automated scoring system (shown on this page) will provide feedback on whether you have completed your tasks correctly.

When you take a challenge lab, you will not be taught new Google Cloud concepts. You are expected to extend your learned skills, like changing default values and reading and researching error messages to fix your own mistakes.

To score 100% you must successfully complete all tasks within the time period!

In this challenge lab, you will be taking help of Gemini to complete the given tasks.

Gemini for Google Cloud is an always-on AI collaborator that provides help to users of all skill levels where they need it. In this lab, you use Gemini to get information you need to create resources in the tasks.

Setup and requirements

Before you click the Start Lab button

Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.

This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.

To complete this lab, you need:

• Access to a standard internet browser (Chrome browser recommended).

• Time to complete the lab—remember, once you start, you cannot pause a lab.

Activate Cloud Shell

Cloud Shell is a virtual machine that is loaded with development tools. It offers a persistent 5GB home directory and runs on the Google Cloud. Cloud Shell provides command-line access to your Google Cloud resources.

1. Click Activate Cloud Shell at the top of the Google Cloud console.

2. Click through the following windows:

   • Continue through the Cloud Shell information window.
   • Authorize Cloud Shell to use your credentials to make Google Cloud API calls.

When you are connected, you are already authenticated, and the project is set to your Project_ID, . The output contains a line that declares the Project_ID for this session:

gcloud is the command-line tool for Google Cloud. It comes pre-installed on Cloud Shell and supports tab-completion.

3. (Optional) You can list the active account name with this command:

4. Click Authorize.

Output:

5. (Optional) You can list the project ID with this command:

Output:

Challenge scenario

You are starting your career as a junior cloud architect. In this role, you have been assigned to work on a team project that requires you to use service accounts, configure IAM permissions using the gcloud command line interface (CLI), add custom roles, and use the client libraries to access BigQuery from a service account.

You are expected to have the skills and knowledge to complete the tasks that follow. Also, you can take help from Gemini to identify CLI commands or steps to complete the tasks.

Your challenge

For this challenge, you are asked to create a service account, assign required roles, configure IAM permissions using the gcloud CLI, create a custom role using a YAML file, and use the client libraries to access BigQuery from a service account.

You are asked to:

• Configure a service account using the gcloud CLI.
• Grant IAM permissions to a service account using the gcloud CLI.
• Create a compute instance using the service account.
• Create a custom role using a YAML file.
• Use the client libraries to access BigQuery from a service account.

Create all the resources in region and zone.

Each task is described in detail below, good luck!

Task 1. Enable and Explore Gemini (optional)

Since you are going to use Gemini, let's quickly enable and explore the Gemini.

In this task, you use the Gemini pane to enter prompts and view the responses from Gemini. Prompts are questions or statements that describe the help that you need. Prompts can include context from existing code that Google Cloud analyzes to provide more useful or complete responses. For more information on writing prompts to generate good responses, see Write better prompts for Gemini.

To prompt Gemini about Google Cloud services, perform these steps:

1. Sign in to the Google Cloud Console.

2. Click on the Gemini icon () in the top-right corner of the Google Cloud console toolbar.

3. Select Get Gemini Cloud Assist at no cost then click Enable Gemini Cloud Assist at no cost to enable the Gemini Cloud Assist API.

4. Once enabled, click Start Chatting.

Enter the following prompt:

Task 2. Create a service account using the gcloud CLI

For this task, use Cloud Shell to perform the tasks that follow. You will create a service account by taking the help of Gemini.

1. In Cloud Shell, create a service account named devops.

Click Check my progress to verify the objective. Create a service account using gcloud CLI

Task 3. Grant IAM permissions to a service account using the gcloud CLI

1. Since you will be using the project id and the service account multiple times, it is a good idea to export the project id and service account into local variables in Cloud Shell.

For this task, you need to assign the required roles to a service account using the gcloud CLI.

2. Similarly, store the service account email address in a local variable called SA.

3. To complete this task, in Cloud Shell, give the service account the role of iam.serviceAccountUser with the permissions compute.instanceAdmin.

Click Check my progress to verify the objective. Grant IAM permissions to a service account using gcloud CLI

Task 4. Create a compute instance with a service account attached using gcloud

1. In Cloud Shell, create a compute instance named vm-2 with the devops service account attached that you created in Task 2.

2. SSH into the vm-2 VM instance. Try to create and list an instance from vm-2 to verify you have the necessary permissions via the service account.

Click Check my progress to verify the objective. Create a compute instance with a service account attached using gcloud

Task 5. Create a custom role using a YAML file

1. In Cloud Shell, create a YAML file named role-definition.yaml that has a custom role definition with the permissions cloudsql.instances.connect and cloudsql.instances.get using Gemini.

2. Execute the gcloud command to create a role at the project level using the YAML file.

Click Check my progress to verify the objective. Create a custom role using a YAML file

Task 6. Use the client libraries to access BigQuery from a service account

For this task, you will query the BigQuery public datasets from an instance with the help of a service account which has the necessary roles configured. Login to the Google Cloud console using the username and password provided.

1. Create a service account named bigquery-qwiklab and assign it the role of BigQuery Data Viewer and BigQuery User.

2. Create a VM instance named bigquery-instance using the service account bigquery-qwiklab.

3. SSH into the bigquery-instance and install the dependencies.

4. Use the following code to create a Python file.

5. Replace the YOUR_PROJECT_ID and YOUR_SERVICE_ACCOUNT variables with your credentials and run the file using a Python3 command:

Click Check my progress to verify the objective. Use the client libraries to access BigQuery from a service account

Congratulations!

Congratulations! You have successfully created Google Cloud service accounts, assigned roles to service accounts, configured IAM permissions using the gcloud CLI, and created a custom role by taking the help of the Gemini Prompt.

Google Cloud training and certification

...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.

Manual Last Updated October 27, 2026

Lab Last Tested October 27, 2026

Copyright 2026 Google LLC. All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.