Examkin

Question

Difficulty: EasyConfiguring Service Account Impersonation and Workload Identity

A Cloud Engineer needs to allow a developer to execute gcloud CLI commands by short-lived impersonation of a dedicated deployment service account, without creating or downloading service account keys. Which IAM role should be assigned to the developer on the target service account?

  1. Service Account Token Creator (roles/iam.serviceAccountTokenCreator)Answer
  2. B
    Service Account Key Admin (roles/iam.serviceAccountKeyAdmin)
  3. C
    Editor (roles/editor)
  4. D
    Security Admin (roles/iam.securityAdmin)

Answer

The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) should be assigned to the developer on the target service account.
The Service Account Token Creator role provides the exact permissions required to mint short-lived tokens and impersonate a Google Cloud service account without creating service account keys.

Step-by-Step Solution

1
Identify the goal of keyless service account delegation.
The developer needs short-lived credential access via impersonation without generating persistent JSON private keys.
Impersonation eliminates key management overhead and security risks associated with long-lived key files.
2
Determine the predefined IAM role specific to token minting.
Select the Service Account Token Creator role.
This role includes the iam.serviceAccounts.getAccessToken permission needed to generate impersonation tokens for gcloud commands.

Key Concept

Service Account Impersonation Roles
Estimated Time:1m 0s
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic