Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

An organization is establishing strict compliance guardrails for service account administration in Google Cloud. A dedicated security team created a custom service account named `[email protected]` in project `proj-backend`. Developers in the project need to attach this service account to newly deployed Cloud Run services. However, security policy strictly forbids developers from modifying service account permissions, creating key files, or managing other service accounts in the project. Which IAM role configuration meets these security requirements while applying the principle of least privilege?

  1. Grant the developers the Service Account User role (roles/iam.serviceAccountUser) bound directly on the sa-app-deployer service account resource.Answer
  2. B
    Grant the developers the Editor primitive role (roles/editor) at the project level for proj-backend.
  3. C
    Generate a private JSON key file for sa-app-deployer and assign the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the developer group at the organization level.
  4. D
    Grant the developers the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level to ensure inheritance down to the individual service account.

Answer

Grant the developers the Service Account User role (roles/iam.serviceAccountUser) bound directly on the specific service account resource.
To allow a user or group to attach a service account to a GCP compute resource without granting permission to manage service accounts, you must grant the Service Account User role (roles/iam.serviceAccountUser) on that specific service account resource. Binding the role on the individual service account rather than at the project level enforces strict least-privilege control.

Step-by-Step Solution

1
Identify the minimal permission required for workload attachment
The permission required to attach a service account to a compute resource (like Cloud Run or Compute Engine) is iam.serviceAccounts.actAs, which is provided by the Service Account User role (roles/iam.serviceAccountUser).
Developers only need to attach the service account to compute workloads, not manage IAM or service account metadata.
2
Determine the optimal resource scope for IAM binding
Binding roles/iam.serviceAccountUser on the specific service account resource ([email protected]) restricts the actAs permission strictly to that identity.
Granting the role at the project level would allow developers to attach any service account in the project, violating least privilege.
3
Verify compliance with security guardrails
Resource-level binding prevents developers from creating service account keys, modifying IAM policies, or managing other identities in the project.
This guarantees full alignment with security mandates prohibiting identity management rights.

Key Concept

Fine-grained IAM Delegation for Service Accounts
Estimated Time:2m 0s
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic