Examkin

Question

Difficulty: HardConfiguring Service Account Impersonation and Workload Identity

A company requires a team of data analysts to execute analytical queries against a BigQuery dataset in the analytics-prod project from their local workstations. To strictly align with GCP security best practices, long-lived service account keys must not be created or downloaded. The analysts must perform operations using the identity of a dedicated service account, [email protected], which already possesses the necessary BigQuery permissions. Which configuration properly enables the analysts to impersonate this service account while following the principle of least privilege?

  1. Grant the data analysts group the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the sa-bq-executor service account resource, and instruct analysts to run CLI commands with the --impersonate-service-account flag.Answer
  2. B
    Create and export a JSON service account key for sa-bq-executor, then distribute the key file to the analysts to set their GOOGLE_APPLICATION_CREDENTIALS environment variable.
  3. C
    Grant the data analysts group the Service Account User role (roles/iam.serviceAccountUser) on the target service account and instruct them to authenticate directly via gcloud config set account.
  4. D
    Grant the data analysts group the Project Editor role (roles/editor) at the project level to automatically grant permission to act as any service account in the project.

Answer

Granting the data analysts group the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the specific target service account allows them to generate short-lived tokens and use the --impersonate-service-account flag, adhering to keyless security best practices and least privilege.
To impersonate a service account for local CLI operations without exporting long-lived service account keys, principals must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) directly on the target service account resource. They can then specify the target identity using flags such as --impersonate-service-account in gcloud commands.

Step-by-Step Solution

1
Identify keyless authentication requirement
Avoid generating or exporting long-lived JSON service account keys.
Security policy mandates short-lived credential generation via identity impersonation.
2
Determine the minimum required IAM role for token creation
Select roles/iam.serviceAccountTokenCreator on the target service account resource.
This role grants the iam.serviceAccounts.getAccessToken permission needed for gcloud impersonation.
3
Configure local client invocation
Use gcloud or client libraries with the --impersonate-service-account flag.
The flag directs gcloud to request short-lived tokens from GCP IAM on behalf of the authenticated user.

Key Concept

Service Account Impersonation via IAM Token Creator Role
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic