Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

An automated analytics pipeline deployed on Cloud Run operates using the runtime service account [email protected]. To complete batch jobs, it must mint short-lived OAuth 2.0 access tokens to impersonate [email protected] without using static credentials. Following the principle of least privilege, which configuration enables this impersonation capability?

  1. Assign the predefined IAM role roles/iam.serviceAccountTokenCreator on the target bq-exporter service account to principal [email protected].Answer
  2. B
    Assign the predefined IAM role roles/iam.serviceAccountUser on the target bq-exporter service account to principal [email protected].
  3. C
    Create a long-lived service account key file in JSON format for bq-exporter and store it in Secret Manager for Cloud Run to access.
  4. D
    Bind the Project Editor primitive role to [email protected] across the target project resource hierarchy.

Answer

Assign the predefined IAM role roles/iam.serviceAccountTokenCreator on the target bq-exporter service account to principal [email protected].
To impersonate a target service account and generate short-lived tokens keylessly, the principal making the call must be granted the roles/iam.serviceAccountTokenCreator role directly on that target service account.

Step-by-Step Solution

1
Identify the source principal and target resource
The source principal is [email protected] and the target resource being impersonated is [email protected].
Impersonation requires configuring IAM policy bindings directly on the target service account.
2
Determine the required permission capability
The requirement specifies generating short-lived access tokens without long-lived keys.
Minting short-lived tokens requires the iam.serviceAccounts.getAccessToken permission contained in the Service Account Token Creator role.
3
Select the minimum necessary IAM role binding
Assigning roles/iam.serviceAccountTokenCreator on the target service account grants the exact permission needed for impersonation without granting overprivileged project access.
This satisfies GCP security best practices and the principle of least privilege.

Key Concept

Service Account Impersonation via Service Account Token Creator Role
Estimated Time:1m 30s
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic