Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

An organization requires developers to run local database migration scripts against a Cloud SQL instance by assuming the identity of a dedicated service account `[email protected]`. In accordance with Google Cloud security best practices, static service account key creation is strictly disabled by organizational policy. Which configuration allows the developers to authenticate as the service account while adhering to the security policy?

  1. Grant the developers the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource to enable IAM service account impersonation.Answer
  2. B
    Generate a JSON service account key for [email protected] and distribute it securely to developer workstations.
  3. C
    Grant the developers the primitive Editor role (roles/editor) at the project level to grant full access to all service account operations in the project.
  4. D
    Grant the Service Account User role (roles/iam.serviceAccountUser) at the project level and apply an IAM deny policy on the Cloud SQL instance level to restrict authorization.

Answer

Grant the developers the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource to enable IAM service account impersonation.
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) granted on the specific service account resource allows users to impersonate the service account and obtain short-lived OAuth 2.0 access tokens. This meets the requirement of authenticating as the service account while following security best practices that prohibit long-lived static key exports.

Step-by-Step Solution

1
Identify the authentication requirement and security constraint
Developers must act as the service account db-migrator without using long-lived JSON keys.
Security best practices recommend short-lived credentials over persistent credential keys.
2
Select the appropriate IAM mechanism for short-lived credentials
Service account impersonation using roles/iam.serviceAccountTokenCreator.
Impersonation allows principals to generate short-lived OAuth 2.0 access tokens or ID tokens on demand.
3
Apply the role at the correct resource scope
Bind roles/iam.serviceAccountTokenCreator on the service account resource itself.
Granting permissions directly on the target service account enforces least privilege.

Key Concept

Service Account Impersonation vs. Static Key Management
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic