A security lead mandates that developers executing maintenance scripts from their local workstations must access BigQuery datasets as the target service account [email protected] without downloading service account keys. Which of the following configurations are required to establish valid service account impersonation for the developer account [email protected]? (Select TWO correct answers.)
- Grant [email protected] the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource.Answer
- Execute gcloud commands with the --impersonate-service-account=data-exporter@analytics-prod.iam.gserviceaccount.com flag or set the corresponding gcloud configuration property.Answer
- CGenerate a short-lived JSON key pair using gcloud iam service-accounts keys create and store it in local user environment variables.
- DAssign the primitive Owner role (roles/owner) to [email protected] at the project level to bypass explicit IAM token creation delegation.
Answer
To configure service account impersonation using the gcloud CLI without service account keys, grant the user the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account and execute commands using the --impersonate-service-account flag.
Establishing secure keyless service account impersonation requires granting the requesting principal the Service Account Token Creator role on the target service account and configuring local CLI tools using the --impersonate-service-account flag to request short-lived access tokens dynamically.
Step-by-Step Solution
Key Concept
Service Account Impersonation via gcloud CLI