An enterprise cloud team needs to configure an automated nightly backup script running on an on-premises server to upload database backups to a Cloud Storage bucket in Google Cloud project `prod-data-vault`. Following Google Cloud security best practices, the team wants to eliminate long-lived service account keys while enforcing the principle of least privilege. Which TWO configuration steps should the cloud engineer implement?
- Configure Workload Identity Federation between the on-premises Identity Provider and Google Cloud to allow the script to authenticate using short-lived tokens.Answer
- Grant the dedicated service account the Storage Object Creator role (`roles/storage.objectCreator`) directly on the destination Cloud Storage bucket.Answer
- CGenerate an exported service account JSON key file and download it to the on-premises server to authenticate the backup script.
- DAssign the primitive Editor role (`roles/editor`) to the service account at the Google Cloud project level.
- EEnable the Cloud Storage API at the organization resource node to grant storage access across all projects.
Answer
To securely allow an on-premises backup script to upload files to a Cloud Storage bucket without long-lived keys and with minimum privilege, you must configure Workload Identity Federation for keyless authentication and grant the service account the Storage Object Creator role directly on the target bucket.
Configuring Workload Identity Federation allows on-premises workloads to authenticate with Google Cloud using short-lived federated credentials, avoiding exported long-lived service account keys. Furthermore, granting the Storage Object Creator role directly on the target bucket ensures that the service account receives only the permissions necessary to write objects into that specific destination.
Step-by-Step Solution
Key Concept
Workload Identity Federation and Least-Privilege IAM Bindings for Service Accounts