Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

An organization uses an automated security auditing script running on a centralized admin virtual machine. The script needs temporary credentials to inspect configuration settings across multiple Google Cloud projects by impersonating a target service account named `[email protected]`. The security policy strictly prohibits creating or downloading long-lived service account key files. Which IAM configuration should the cloud engineer apply to enable this setup while adhering to the principle of least privilege?

  1. Grant the admin VM's identity the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the auditor service account.Answer
  2. B
    Generate a JSON service account key for auditor-sa and store it securely in Secret Manager for the script to download during execution.
  3. C
    Grant the admin VM's identity the Service Account User role (roles/iam.serviceAccountUser) on the target service account.
  4. D
    Grant the admin VM's identity the Project Editor primitive role (roles/editor) on the project containing the auditor service account.

Answer

Grant the admin VM's identity the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the auditor service account.
To impersonate a service account and generate short-lived credentials (like access tokens or ID tokens), a principal must have the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) granted on the target service account. This allows keyless authentication while adhering to least privilege.

Step-by-Step Solution

1
Identify the authentication requirement
The automated auditing script requires short-lived credential generation for service account impersonation without downloading long-lived JSON keys.
Security policy forbids static service account keys.
2
Evaluate required IAM permissions for impersonation
The Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) grants `iam.serviceAccounts.getAccessToken` and related permissions needed to generate short-lived tokens.
This enables secure, direct impersonation of the target service account.
3
Apply least privilege scoping
Bind `roles/iam.serviceAccountTokenCreator` directly on the target service account resource rather than assigning broad project-level roles.
Ensures the admin principal can only impersonate the specific designated auditing identity.

Key Concept

Service Account Impersonation and Short-Lived Credentials
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic