Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

A security compliance team needs to provide access for an external vulnerability scanner running in an on-premises data center. The scanner must read compute instance details within the project `sec-ops-prod`. Which strategy should the team implement to adhere to Google Cloud security best practices?

  1. Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and configure Workload Identity Federation for keyless authentication.Answer
  2. B
    Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and export a service account JSON key file to authenticate the scanner.
  3. C
    Create a user-managed service account, grant it the Editor primitive role on the project, and configure Workload Identity Federation for keyless authentication.
  4. D
    Grant the Compute Viewer (roles/compute.viewer) role at the organization level to the service account, and rely on resource hierarchy inheritance to grant access to the project.

Answer

Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and configure Workload Identity Federation for keyless authentication.
The recommended security approach for on-premises or external workloads accessing Google Cloud resources is to create a dedicated user-managed service account, grant the minimal predefined IAM role (roles/compute.viewer) restricted to the target project scope, and authenticate using Workload Identity Federation to avoid managing service account JSON keys.

Step-by-Step Solution

1
Identify identity management requirements for external workloads
Workload Identity Federation should be selected over static service account JSON keys to enable keyless authentication from external environments.
Service account keys create security risks due to long life spans and potential leaks.
2
Select the appropriate IAM role adhering to least privilege
Assign the predefined role roles/compute.viewer rather than a broad primitive role like Editor or granting access at the organization level.
Predefined roles limit access to the specific resources and permissions needed by the workload.

Key Concept

Creating service accounts with predefined roles and keyless authentication via Workload Identity Federation
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic