Examkin

Question

Difficulty: EasyConfiguring Service Account Impersonation and Workload Identity

A security policy prohibits developers from creating or downloading private service account keys. An administrator needs to allow a developer's identity to temporarily generate short-lived credentials for a target service account to execute deployment tasks. Which IAM role should be granted to the developer's identity on the target service account?

  1. Service Account Token Creator (roles/iam.serviceAccountTokenCreator)Answer
  2. B
    Service Account Key Admin (roles/iam.serviceAccountKeyAdmin)
  3. C
    Editor (roles/editor)
  4. D
    Security Admin (roles/iam.securityAdmin)

Answer

Granting the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role on the target service account.
Granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account enables an authorized principal to generate short-lived OAuth2 tokens and impersonate the service account securely without creating or downloading private keys.

Step-by-Step Solution

1
Identify the security requirement.
The requirement demands identity delegation via impersonation to mint short-lived tokens while avoiding long-lived private key creation.
Keyless authentication via service account impersonation aligns with GCP security best practices.
2
Select the appropriate fine-grained IAM role.
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) provides permission to create OAuth2 access tokens and sign payloads as the target service account.
Binding this role on the specific service account resource adheres strictly to the principle of least privilege.

Key Concept

Configuring Service Account Impersonation
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic