Examkin

Question

Difficulty: HardConfiguring Service Account Impersonation and Workload Identity

An enterprise application hosted on Compute Engine instances in project `telemetry-prod` needs to publish metrics to a Cloud Pub/Sub topic residing in project `shared-monitoring-prod`. To adhere to security directives requiring keyless identity delegation across projects, the source service account `[email protected]` must obtain short-lived credentials for the target service account `[email protected]`. Which IAM configuration correctly enables this cross-project impersonation while following the principle of least privilege?

  1. Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) to `[email protected]` on the resource `[email protected]`.Answer
  2. B
    Export a JSON private key for `[email protected]` and store it securely in the environment variables of the Compute Engine instances.
  3. C
    Grant the Project Owner role (`roles/owner`) to `[email protected]` at the `shared-monitoring-prod` project level.
  4. D
    Revoke IAM permissions on `[email protected]` at the target project level to force default permission evaluation from a parent folder.

Answer

Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) to `[email protected]` directly on the target service account `[email protected]`.
To configure service account impersonation, the calling identity must be granted the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the target service account resource. This setup allows `vm-worker` to generate short-lived tokens for `pubsub-publisher` without requiring static credentials or project-wide administrative rights.

Step-by-Step Solution

1
Identify the authentication requirement
The application requires short-lived credential generation for keyless identity delegation across two distinct GCP projects.
Security directives explicitly mandate keyless impersonation rather than downloadable service account keys.
2
Select the appropriate IAM role for token generation
The predefined role `roles/iam.serviceAccountTokenCreator` enables an identity to impersonate a target service account by creating short-lived tokens.
This role grants specific permissions such as `iam.serviceAccounts.getOpenIdToken` and `iam.serviceAccounts.signBlob`.
3
Apply the IAM policy at the most granular resource scope
Bind `roles/iam.serviceAccountTokenCreator` directly to `[email protected]` on the resource `[email protected]`.
Granting the role on the specific service account resource instead of the entire project complies with the principle of least privilege.

Key Concept

Service Account Impersonation via IAM Token Creator Role
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic