Examkin

Question

Difficulty: HardConfiguring Service Account Impersonation and Workload Identity

A financial services company runs a batch data processing pipeline on Compute Engine virtual machines using a workload service account named [email protected]. The pipeline requires short-lived authorization to perform operations against Cloud Storage buckets in a separate data project, acting as the target service account [email protected]. Corporate governance explicitly forbids creating and downloading service account JSON keys. Which IAM role assignment adheres to the principle of least privilege to grant app-worker permission to impersonate storage-mgr?

  1. A
    Grant [email protected] the Service Account User role (roles/iam.serviceAccountUser) on [email protected].
  2. Grant [email protected] the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on [email protected].Answer
  3. C
    Create a downloadable service account JSON key for [email protected] and store it in Secret Manager for app-worker to fetch at runtime.
  4. D
    Grant [email protected] the primitive Owner role (roles/owner) on the target project proj-data.

Answer

Grant [email protected] the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on [email protected].
To allow a principal (such as a source service account) to impersonate a target service account and generate short-lived OAuth 2.0 tokens, the principal must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource. Binding this role directly on the target identity enforces the principle of least privilege while complying with keyless security mandates.

Step-by-Step Solution

1
Identify authentication constraints and requirements
The source workload service account (app-worker) must perform actions as the target service account (storage-mgr) without using exported service account JSON keys.
Corporate security policy explicitly bans exported service account keys, mandating short-lived credential impersonation.
2
Select the specific IAM role required for token creation and identity delegation
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) contains permissions such as iam.serviceAccounts.getAccessToken required to mint short-lived OAuth 2.0 access tokens.
Impersonation requires token creation permissions rather than resource attachment permissions.
3
Apply the IAM role resource binding using least privilege principles
Grant roles/iam.serviceAccountTokenCreator specifically on the target service account resource (storage-mgr) to the caller principal (app-worker).
Binding the role at the target service account resource level restricts impersonation privileges strictly to that identity.

Key Concept

Service Account Impersonation via Service Account Token Creator Role
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic