Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

A cloud engineer needs to set up secure, keyless authentication for an external CI/CD pipeline to deploy containerized microservices to Google Cloud Run using Workload Identity Federation. In what order should the engineer perform the following steps to configure the service account identity and authorization according to GCP security best practices?

  1. 1Create a dedicated user-managed service account in the GCP project to represent the CI/CD deployment workload.
  2. 2Grant the service account the minimum predefined IAM roles (e.g., Cloud Run Admin and Service Account User) at the project level.
  3. 3Create a Workload Identity Pool and Workload Identity Provider configured with the external identity provider's OIDC issuer URL and attribute mappings.
  4. 4Add an IAM policy binding granting the Workload Identity User role (`roles/iam.workloadIdentityUser`) on the service account to the external workload identity principal.

Answer

The correct sequence begins by creating the dedicated service account, granting it the required deployment roles, provisioning the Workload Identity Pool and Provider for external OIDC trust, and finally binding the Workload Identity User role on the service account to the external principal.
Establishing keyless deployment via Workload Identity Federation follows a clear dependency sequence: create the target GCP service account identity, grant it specific predefined permissions needed for the workload, set up the Workload Identity Pool/Provider to validate external OIDC tokens, and grant the external workload principal the Workload Identity User role on the service account to allow secure impersonation.

Step-by-Step Solution

1
Create the user-managed service account using `gcloud iam service-accounts create`.
A new service account resource is created in the project.
An explicit GCP service account identity is required before permissions can be assigned or external identities bound.
2
Assign required predefined IAM roles to the service account using `gcloud projects add-iam-policy-binding`.
The service account receives specific resource management permissions.
Following the principle of least privilege ensures the service account can only perform designated deployment actions.
3
Configure the Workload Identity Pool and Provider using `gcloud iam workload-identity-pools` commands.
GCP IAM establishes federated trust with the external OIDC identity provider.
The pool and provider define how external tokens are validated and mapped to GCP attributes.
4
Grant `roles/iam.workloadIdentityUser` on the service account to the external identity using `gcloud iam service-accounts add-iam-policy-binding`.
The external workload identity gains authorization to impersonate the service account.
This step enables keyless authentication without requiring exportable, long-lived JSON service account keys.

Key Concept

Workload Identity Federation Service Account Configuration Sequence
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic