Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

A cloud administrator needs to grant an external automated system temporary access to collect metrics from Compute Engine instances within a Google Cloud project. To adhere to Google Cloud security standards, the administrator must avoid generating and downloading long-lived service account JSON keys. Which implementation strategy should the administrator select?

  1. Create a dedicated service account with the predefined Monitoring Viewer role and configure Workload Identity Federation to issue short-lived credentials to the external system.Answer
  2. B
    Create a service account with the Monitoring Viewer role, export a JSON private key, and store the key in Google Cloud Secret Manager for the external service to retrieve.
  3. C
    Create a service account, assign it the primitive Owner role at the project level, and configure short-lived service account impersonation for the external system.
  4. D
    Grant the external system's identity the Monitoring Viewer role at the organization level, expecting explicit deny policies on unneeded child projects to restrict access.

Answer

Create a dedicated service account with the predefined Monitoring Viewer role and configure Workload Identity Federation to issue short-lived credentials to the external system.
The correct strategy uses a dedicated service account bound strictly to the required predefined role (Monitoring Viewer) and uses Workload Identity Federation to grant short-lived access without creating long-lived private key files.

Step-by-Step Solution

1
Identify the required level of access for metric collection
The predefined role roles/monitoring.viewer provides read access to monitoring metrics under the principle of least privilege.
Primitive roles like Owner grant excessive permissions beyond what is needed.
2
Determine the authentication mechanism for workloads outside Google Cloud
Workload Identity Federation allows external workloads to exchange credentials from external identity providers for short-lived Google Cloud service account tokens.
Exporting long-lived service account JSON keys creates maintenance overhead and security risks associated with credential leakage.

Key Concept

Service Account Management and Secure Authentication Best Practices
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic