Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

A DevOps engineer needs to run a database schema migration script from their local workstation using the identity of a dedicated production service account named `[email protected]`. The organization's security policy strictly forbids generating and downloading long-lived service account JSON keys. Which IAM configuration allows the engineer to execute commands on behalf of the service account using gcloud impersonation?

  1. Grant the engineer's user account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource.Answer
  2. B
    Generate a short-lived service account JSON key file via the Cloud Console and export its path to the GOOGLE_APPLICATION_CREDENTIALS environment variable.
  3. C
    Assign the primitive Editor role (roles/editor) to the engineer's user account at the Google Cloud project level.
  4. D
    Grant the engineer's user account the Service Account User role (roles/iam.serviceAccountUser) at the organization resource level.

Answer

Grant the engineer's user account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource.
To impersonate a service account from a local environment or CLI tool using short-lived credentials, a user identity requires the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) bound directly to the target service account.

Step-by-Step Solution

1
Identify the security requirement.
The engineer must run commands as a service account without generating or downloading long-lived JSON keys.
Security policy forbids key export, necessitating IAM service account impersonation.
2
Determine the specific IAM role required for impersonation.
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) grants the permission `iam.serviceAccounts.getAccessToken` required to create short-lived OAuth tokens for impersonation.
The Service Account User role (roles/iam.serviceAccountUser) only allows attaching service accounts to GCP compute resources, not token generation for local CLI impersonation.
3
Apply least privilege scoping.
Grant the role specifically on the `[email protected]` service account resource rather than at the project level.
This restricts impersonation permissions exclusively to the intended service account.

Key Concept

Service Account Impersonation
Estimated Time:1m 30s
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic