An organization enforces a strict security policy prohibiting the creation and downloading of service account JSON keys. A cloud engineer must run local deployment commands using `gcloud` under the identity of `[email protected]`. The engineer has already been granted the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the service account resource. Which method should the engineer use to execute these commands securely?
- Pass the `--impersonate-service-account=deployer@proj-prod-app.iam.gserviceaccount.com` flag or set the `auth/impersonate_service_account` property in `gcloud config`.Answer
- BCreate a service account key using `gcloud iam service-accounts keys create` and set `GOOGLE_APPLICATION_CREDENTIALS` for the session.
- CGrant the engineer the Service Account User role (`roles/iam.serviceAccountUser`) at the project level to automatically inherit the target identity.
- DAssign the primitive Editor role (`roles/editor`) to the engineer on the service account so `gcloud` automatically assumes its identity.
Answer
Configure `gcloud` to use service account impersonation via the `--impersonate-service-account` flag or by setting `auth/impersonate_service_account` in `gcloud config`.
Service account impersonation allows authenticated principals holding the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) to generate short-lived credentials dynamically. Supplying `--impersonate-service-account` in `gcloud` or setting `auth/impersonate_service_account` configures the SDK to transparently request access tokens for the target service account without storing key files.
Step-by-Step Solution
Key Concept
Service Account Impersonation via gcloud