Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

An application deployed on Cloud Run in Project-A needs to publish messages securely to a Cloud Pub/Sub topic located in Project-B. Enterprise security policy strictly forbids generating or downloading service account keys. A dedicated target service account with Pub/Sub Publisher privileges has already been created in Project-B. Which IAM configuration correctly enables the Cloud Run service account in Project-A to generate short-lived credentials for the target service account following Google Cloud best practices?

  1. Grant the Cloud Run service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account in Project-B.Answer
  2. B
    Generate a JSON service account key for the target service account in Project-B, store it in Secret Manager, and grant Secret Accessor rights to Project-A.
  3. C
    Grant the Cloud Run service account the Service Account User role (roles/iam.serviceAccountUser) on the target service account in Project-B.
  4. D
    Grant the Cloud Run service account the Project Editor role (roles/editor) at the Project-B resource hierarchy level.

Answer

Grant the Cloud Run service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account in Project-B.
To impersonate a service account and request short-lived credentials (such as OAuth 2.0 access tokens), the calling identity must be assigned the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account. This allows keyless cross-project authentication adhering to the principle of least privilege.

Step-by-Step Solution

1
Analyze cross-project authentication constraints
The application requires cross-project resource access using short-lived tokens without exporting service account keys.
Service account impersonation is the GCP standard for keyless identity delegation across workloads.
2
Identify the required permission for token generation
Creating OAuth2 tokens or ID tokens via the IAM credentials API requires iam.serviceAccounts.getAccessToken.
This specific permission is provided by the Service Account Token Creator predefined role.
3
Bind the role with least privilege
Grant roles/iam.serviceAccountTokenCreator directly on the target service account resource in Project-B to the Cloud Run default service account principal.
Resource-level role bindings prevent the Cloud Run service account from impersonating unrelated service accounts in Project-B.

Key Concept

Configuring Service Account Impersonation using the Service Account Token Creator role
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic