An organization enforces a strict security directive prohibiting the creation and export of static service account JSON keys. A automated pipeline executing under a source service account `[email protected]` in Project-A must deploy compute resources into Project-B by impersonating a target service account `[email protected]`. Which two IAM configuration actions must be performed to enable this secure impersonation workflow following Google Cloud security best practices? (Select TWO.)
- Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to [email protected] on the [email protected] service account resource.Answer
- Grant the target service account [email protected] the necessary compute deployment permissions within Project-B.Answer
- CGenerate and download a private JSON key for [email protected] and mount it directly into the Project-A deployment pipeline.
- DGrant the primitive Owner role (roles/owner) to [email protected] across Project-A and Project-B.
Answer
Granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the source service account on the target service account resource, and granting the target service account the necessary resource deployment permissions within Project-B.
To establish keyless cross-project impersonation, the calling service account must be given the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) directly on the target service account resource. Additionally, the target service account must be assigned specific predefined IAM roles in the destination project so it can perform the intended deployment tasks upon being impersonated.
Step-by-Step Solution
Key Concept
Service Account Impersonation requires granting the Service Account Token Creator role to the caller on the target service account resource.