Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

A DevOps team is configuring an automated deployment workflow executed from a developer workstation to provision cloud infrastructure inside a staging project named `proj-staging-884`. Organizational security directives prohibit exporting long-lived JSON service account keys to developer machines and mandate the principle of least privilege. The workflow requires creating a dedicated user-managed service account named `deployer-sa` in `proj-staging-884`, granting this service account the `roles/resourcemanager.projectIamAdmin` role on `proj-staging-884`, and enabling developer `[email protected]` to generate short-lived credentials for `deployer-sa` via impersonation. Which sequence of `gcloud` commands correctly fulfills these security and operational requirements?

  1. Run `gcloud iam service-accounts create deployer-sa --project=proj-staging-884`, bind `roles/resourcemanager.projectIamAdmin` to `serviceAccount:[email protected]` on project `proj-staging-884`, and grant `roles/iam.serviceAccountTokenCreator` to `user:[email protected]` on the `deployer-sa` service account resource.Answer
  2. B
    Run `gcloud iam service-accounts create deployer-sa --project=proj-staging-884`, bind `roles/resourcemanager.projectIamAdmin` to `serviceAccount:[email protected]` on project `proj-staging-884`, and execute `gcloud iam service-accounts keys create key.json --iam-account=deployer-sa@proj-staging-884.iam.gserviceaccount.com` for developer authentication.
  3. C
    Run `gcloud iam service-accounts create deployer-sa --project=proj-staging-884`, bind `roles/owner` to `serviceAccount:[email protected]` on project `proj-staging-884`, and grant `roles/iam.serviceAccountUser` to `user:[email protected]` at the project level.
  4. D
    Run `gcloud iam service-accounts create deployer-sa --project=proj-staging-884`, bind `roles/resourcemanager.projectIamAdmin` to `user:[email protected]` at the organization level, expecting child projects to automatically enforce token impersonation without explicit service account IAM bindings.

Answer

The correct sequence creates the user-managed service account in the staging project, assigns the predefined `roles/resourcemanager.projectIamAdmin` role to the service account on the project, and grants `roles/iam.serviceAccountTokenCreator` to the specific user on the service account resource to enable short-lived token generation without static keys.
Creating the service account and assigning `roles/iam.serviceAccountTokenCreator` directly on that service account to the developer user allows keyless impersonation using short-lived credentials while enforcing least privilege with `roles/resourcemanager.projectIamAdmin`.

Step-by-Step Solution

1
Create the user-managed service account
Service account `[email protected]` is provisioned.
Dedicated workloads require user-managed service accounts rather than built-in default accounts.
2
Bind least-privilege predefined IAM role to the service account
Service account receives `roles/resourcemanager.projectIamAdmin` on `proj-staging-884`.
Assigning predefined roles adheres to least privilege while providing needed management rights.
3
Grant token creation role on the service account to the developer identity
User `[email protected]` gains `roles/iam.serviceAccountTokenCreator` on the service account.
Allows short-lived OAuth2 access token generation for impersonation without creating long-lived private key files.

Key Concept

Keyless service account management and IAM impersonation via `roles/iam.serviceAccountTokenCreator`.
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic