Unit 5 roadmap — Configuring access and security

Every objective below is quoted from Google's Associate Cloud Engineer exam guide, retrieved 2026-09-22. Under each topic is that topic's own summary of what the exam actually tests, taken from its lecture.

Topic 1 — Managing Identity and Access Management (IAM)

ACE-U5.T1 · 2 objectives · lecture deck of 11 slides

1. Viewing and creating IAM policies
2. Managing the various role types and defining custom IAM roles (e.g., basic, predefined, custom)

What this topic actually tests. One role, one binding. Many changes? Read, modify, write — a stale etag fails, so retry the whole cycle. Grants add up down the hierarchy; remove one where it was granted. To forbid regardless of grants, use a deny policy. Custom roles live in a project or organization, never a folder — disable to switch off, undelete within 7 days.

Topic 2 — Managing service accounts

ACE-U5.T2 · 6 objectives · lecture deck of 15 slides

1. Creating service accounts
2. Using service accounts in IAM policies with minimum permissions
3. Assigning service accounts to resources
4. Managing IAM of a service account
5. Managing service account impersonation
6. Creating and managing short-lived service account credentials

What this topic actually tests. Principal or resource? roles FOR the service account are minimum grants; roles ON it decide who can use it. User or Token Creator? User attaches; Token Creator impersonates and mints tokens. Where is the grant? on the individual service account, not the project. Key or token? a short-lived token, every time Google offers one.