Examkin

Question

Difficulty: Very hardCreating and Managing Service Accounts

An infrastructure administrator needs to enable an external automation tool running on a developer workstation to mint short-lived OAuth 2.0 access tokens for a specific target service account named `[email protected]`. The organization strictly prohibits creating long-lived private key files and mandates enforcing least-privilege access. Which `gcloud` command accurately grants the minimum required permission to the developer user `[email protected]` on the target service account?

  1. gcloud iam service-accounts add-iam-policy-binding [email protected] --member="user:[email protected]" --role="roles/iam.serviceAccountTokenCreator"Answer
  2. B
    gcloud iam service-accounts keys create key.json --iam-account=data-pipeline-sa@prod-analytics-1234.iam.gserviceaccount.com
  3. C
    gcloud projects add-iam-policy-binding prod-analytics-1234 --member="user:[email protected]" --role="roles/editor"
  4. D
    gcloud services enable iamcredentials.googleapis.com --project=prod-analytics-1234

Answer

The command running `gcloud iam service-accounts add-iam-policy-binding` with the target service account email, assigning the `user:[email protected]` the role `roles/iam.serviceAccountTokenCreator` directly on the resource.
The correct command binds the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly to the identity on the specific service account resource. This enables token generation and service account impersonation dynamically without requiring static key exports.

Step-by-Step Solution

1
Identify the authentication requirement and policy constraints.
Short-lived tokens are required without exporting long-lived private key files.
Security mandates impersonation via token generation over exported static service account keys.
2
Determine the least-privilege IAM role for token creation.
The predefined role `roles/iam.serviceAccountTokenCreator` provides permissions to sign blobs/JWTs and mint access tokens.
Using `roles/iam.serviceAccountUser` only allows attaching service accounts to resources, whereas token creation requires `serviceAccountTokenCreator`.
3
Apply the IAM binding directly to the target service account resource.
Executing `gcloud iam service-accounts add-iam-policy-binding` targets the specific service account resource.
Applying the binding at the service account level restricts the identity's permissions exclusively to that single service account rather than project-wide.

Key Concept

Service Account Impersonation and Token Creation Roles
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic