Examkin

Question

Difficulty: HardConfiguring Service Account Impersonation and Workload Identity

An organization is establishing an automated CI/CD deployment workflow on an external third-party platform that needs to deploy resources into a Google Cloud project. Security policies strictly prohibit exporting or storing long-lived service account JSON key files on external infrastructure. The engineering team decides to set up Workload Identity Federation so the external pipeline can temporarily impersonate a dedicated Google Cloud service account. Which TWO configuration steps must be performed in Google Cloud to complete this setup? (Select TWO.)

  1. Configure a Workload Identity Pool and Provider to establish trust with the external identity provider and map token claims to Google Cloud attributes.Answer
  2. Grant the external workload identity principal the Workload Identity User role (roles/iam.workloadIdentityUser) on the target Google Cloud service account.Answer
  3. C
    Generate and download a private service account JSON key for the deployment service account and store it as an encrypted variable in the external pipeline.
  4. D
    Assign the primitive Owner role (roles/owner) at the Google Cloud project level to the external identity principal so that impersonation permissions inherit down.

Answer

The two required configuration steps are setting up a Workload Identity Pool and Provider to map external token claims, and granting the Workload Identity User role (roles/iam.workloadIdentityUser) on the target Google Cloud service account to the external principal.
To set up keyless authentication for external workloads, Google Cloud requires establishing a trust relationship via a Workload Identity Pool and Provider (to validate and map external ID tokens) and granting the Workload Identity User role on the target service account to the mapped external principal.

Step-by-Step Solution

1
Establish identity federation trust
Create a Workload Identity Pool and a Provider that configures attribute mapping and conditions matching the external identity provider's tokens.
Google Cloud IAM needs to validate incoming tokens from external identity providers and map external attributes to Google Cloud principal identifiers.
2
Authorize identity impersonation
Bind the mapped external principal to the target Google Cloud service account using the roles/iam.workloadIdentityUser role.
IAM requires explicit permission on the target service account granting the federated principal permission to impersonate it.

Key Concept

Workload Identity Federation setup requires creating a Workload Identity Pool and Provider to federate external tokens, along with assigning the roles/iam.workloadIdentityUser role on the target service account to permit keyless impersonation.
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic