Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

A database administrator needs to execute local gcloud CLI commands to update Cloud Spanner schema configurations using the dedicated service account [email protected]. Security policy strictly forbids creating or downloading static service account JSON keys. Which IAM role assignment and gcloud configuration allows the administrator to temporarily assume the identity of the service account?

  1. Grant the administrator the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account, and pass the --impersonate-service-account flag in gcloud commands.Answer
  2. B
    Generate a short-lived service account key file using gcloud iam service-accounts keys create, configure gcloud auth activate-service-account, and delete the key file after execution.
  3. C
    Grant the administrator the primitive Owner role (roles/owner) on the project containing the service account so that all CLI calls automatically run with service account authorization.
  4. D
    Grant the administrator the Service Account User role (roles/iam.serviceAccountUser) on the project, and explicitly deny token creation permissions on the individual service account.

Answer

Grant the administrator the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account, and pass the --impersonate-service-account flag in gcloud commands.
To impersonate a service account using Google Cloud CLI without static service account keys, the user principal performing the action must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account. When the user executes gcloud commands with the --impersonate-service-account flag, gcloud requests short-lived credentials for that service account.

Step-by-Step Solution

1
Identify the security constraint and goal.
The requirement is keyless delegation where a user principal impersonates a target service account via gcloud CLI.
Security directives prohibit static JSON service account key creation.
2
Determine the mandatory IAM role for generating impersonation tokens.
The target identity requires roles/iam.serviceAccountTokenCreator to be granted to the calling user principal.
This permission allows minting short-lived OAuth access tokens on behalf of the target service account.
3
Select the correct gcloud CLI execution mechanism.
Append --impersonate-service-account=spanner-admin@prod-project.iam.gserviceaccount.com to gcloud commands or set gcloud config set auth/impersonate_service_account.
This directs gcloud to fetch short-lived credentials for the target service account using the user's authenticated identity.

Key Concept

Service Account Impersonation via gcloud and IAM Token Creator Role
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic