A cloud operations team is configuring identity and access management for a microservice deployed on Google Cloud infrastructure. They need to create a dedicated user-managed service account and configure it according to Google Cloud security best practices. Which of the following steps should the team perform to fulfill this requirement? (Select TWO.)
- Create a new user-managed service account in the project using the gcloud iam service-accounts create command.Answer
- Grant the service account specific predefined IAM roles that contain only the permissions required for its workload.Answer
- CGenerate a downloadable JSON service account key and embed it inside the application container code for authentication.
- DGrant the service account the primitive Owner or Editor role at the project level to simplify permission management.
- EEnable the IAM Service Account API exclusively at the Google Cloud Organization level rather than in the service project.
Answer
The correct steps are creating a custom user-managed service account using the gcloud CLI tool and granting it specific predefined IAM roles that align with the principle of least privilege.
Creating a dedicated user-managed service account using the gcloud command line interface isolates workload identity. Assigning specific predefined IAM roles ensures that the service account operates strictly under the principle of least privilege.
Step-by-Step Solution
Key Concept
Creating User-Managed Service Accounts and Applying Least Privilege