Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

A security engineer must enable a developer to manage Cloud Storage buckets in a production project using service account impersonation, eliminating the need for long-lived service account keys. What is the correct sequence of steps to establish and verify this impersonated access?

  1. 1Grant the target service account the Storage Admin role on the destination project.
  2. 2Grant the developer's user identity the Service Account Token Creator role on the target service account.
  3. 3Authenticate the developer's local environment using gcloud auth login.
  4. 4Execute gcloud storage commands specifying the --impersonate-service-account flag with the target service account email.

Answer

The correct order to establish service account impersonation begins by assigning resource permissions to the target service account, granting the Service Account Token Creator role on the service account to the user, authenticating the user identity, and executing gcloud commands with the impersonation flag.
To configure service account impersonation securely, the target service account must first be granted necessary resource access permissions (Storage Admin). Next, the user principal must be granted the Service Account Token Creator role directly on the target service account. The user then authenticates their identity via gcloud auth login, and finally passes the --impersonate-service-account flag when running CLI commands.

Step-by-Step Solution

1
Assign required resource-level IAM roles to the target service account.
The target service account acquires permission to manage Cloud Storage buckets.
Before impersonation can yield useful access, the target service account must possess the necessary resource privileges.
2
Grant roles/iam.serviceAccountTokenCreator on the service account to the developer user principal.
The developer account is authorized to mint short-lived credentials for the target service account.
Impersonation requires explicit delegation via the Service Account Token Creator role on the service account resource.
3
Run gcloud auth login with the developer user credentials.
Active user authentication token is established locally.
The CLI needs valid caller credentials to request short-lived impersonated tokens from IAM.
4
Append --impersonate-service-account to gcloud commands.
Commands execute under the permissions of the service account without requiring static key files.
Passing the impersonation flag requests Google Cloud IAM to issue short-lived credentials for the command duration.

Key Concept

Configuring Service Account Impersonation
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic