Examkin

Question

Difficulty: HardConfiguring Service Account Impersonation and Workload Identity

An organization mandates that external deployment pipelines running outside Google Cloud must access Cloud Storage buckets without using downloadable credential keys. A cloud engineer configures Workload Identity Federation to establish trust between the external identity provider and Google Cloud. Which IAM role assignment on the target Google Cloud service account is required to allow the external workload principal to obtain short-lived credentials?

  1. Grant the external workload principal the Workload Identity User role (roles/iam.workloadIdentityUser) directly on the target service account.Answer
  2. B
    Create and export a JSON service account key for the target service account and store it as an encrypted secret in the external deployment pipeline.
  3. C
    Grant the external workload principal the primitive Editor role (roles/editor) at the project level.
  4. D
    Grant the target service account the Workload Identity User role (roles/iam.workloadIdentityUser) at the organization resource level so permissions inherit down.

Answer

Grant the external workload principal the Workload Identity User role (roles/iam.workloadIdentityUser) directly on the target service account.
Workload Identity Federation allows external workloads to exchange external tokens for short-lived GCP credentials by granting the external workload principal the Workload Identity User role (roles/iam.workloadIdentityUser) on the target service account resource.

Step-by-Step Solution

1
Identify the authentication requirement
External workloads require keyless access to Google Cloud resources via Workload Identity Federation.
Security policies strictly forbid downloading long-lived JSON service account keys.
2
Determine the necessary IAM binding on the target service account
The external principal identifier (principal://iam.googleapis.com/...) must be bound to the target service account.
Identity delegation via Workload Identity Federation requires authorizing the specific federated principal to impersonate the service account.
3
Select the correct predefined IAM role for Workload Identity
Assign roles/iam.workloadIdentityUser to the principal on the target service account.
This role explicitly allows the specified identity to exchange external OIDC tokens for short-lived Google Cloud service account access tokens.

Key Concept

Configuring Service Account Impersonation and Workload Identity
Estimated Time:2m 0s
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic