A system administrator is configuring a automated backup utility running on an internal corporate server. The utility must periodically upload database backups to a specific Cloud Storage bucket named `prod-backups-bucket` residing in project `prod-data-repository`. Following Google Cloud security best practices for credential management and access control, which strategy should the administrator implement?
- Create a user-managed service account, assign it the predefined `roles/storage.objectCreator` role on the specific bucket, and use service account impersonation or Workload Identity Federation rather than exporting a permanent JSON key file.Answer
- BCreate a user-managed service account, grant it the primitive `roles/editor` role at the project level, and export a downloadable JSON service account key to store on the corporate server.
- CCreate a user-managed service account with the `roles/storage.objectCreator` role, generate a persistent JSON service account key, and copy the key file to the corporate server for authentication.
- DEnable the Cloud Storage API at the parent Organization level and rely on default resource hierarchy permission inheritance to automatically grant write access to all internal servers.
Answer
Create a user-managed service account, assign it the predefined `roles/storage.objectCreator` role on the specific bucket, and use short-lived authentication mechanisms such as Workload Identity Federation or service account impersonation instead of exporting static service account keys.
Google Cloud security best practices dictate using predefined roles over primitive roles, scoping permissions to the narrowest resource possible (the target bucket), and avoiding long-lived static JSON service account keys in favor of short-lived credentials or credential federation.
Step-by-Step Solution
Key Concept
Service Account Best Practices & Least Privilege IAM