Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

A data analyst must execute a scheduled Python script from an on-premises workstation to pull analytics data from BigQuery using a dedicated service account named `[email protected]`. Organization security policies explicitly prohibit generating or downloading long-lived service account JSON key files to local machines. The analyst has already authenticated their personal user identity using `gcloud auth login`. Which configuration best satisfies this security requirement while adhering to the principle of least privilege?

  1. Grant the data analyst's user account the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account.Answer
  2. B
    Generate a service account JSON key file for `bq-reader` and set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable on the workstation.
  3. C
    Grant the data analyst's user account the primitive Owner role (`roles/owner`) at the project level.
  4. D
    Grant the data analyst's user account the Service Account User role (`roles/iam.serviceAccountUser`) at the organization level so it overrides resource-level restrictions.

Answer

Grant the data analyst's user account the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account.
Granting the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the target service account enables the user to generate short-lived credentials via `gcloud` or Google API client libraries. This completely removes the need for long-lived JSON service account keys while adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the security requirement regarding authentication without key files.
Long-lived service account JSON keys cannot be created or downloaded to local workstations.
Security policies require keyless authentication using identity impersonation.
2
Determine the minimum IAM role required for identity impersonation.
The user requires `roles/iam.serviceAccountTokenCreator` granted on the specific service account resource.
This role allows the user to mint short-lived credentials (OIDC/OAuth2 tokens) for the service account.
3
Apply the principle of least privilege.
Grant the role strictly on the target service account rather than broadly at the project or organization level.
Restricting the IAM binding to the target service account resource prevents unauthorized impersonation of other service accounts.

Key Concept

Service Account Impersonation via Service Account Token Creator Role
Estimated Time:1m 30s
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic