An operations engineering team is configuring an application running on a Compute Engine instance to read sensitive configuration data from Secret Manager. Security policies strictly prohibit creating or downloading service account JSON keys. The application runs under the VM instance's service account (`[email protected]`) and must temporarily impersonate a dedicated target service account (`[email protected]`) to retrieve the secrets. Which TWO actions must be completed to grant the minimum necessary permissions for this impersonation setup? (Select TWO.)
- Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on `[email protected]`.Answer
- Grant `[email protected]` the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) on the required secret.Answer
- CGenerate a short-lived service account key for `[email protected]` and store it in the Compute Engine instance metadata.
- DGrant `[email protected]` the primitive Editor role (`roles/editor`) at the project level.
Answer
To configure secure service account impersonation without service account keys, grant the calling service account the Service Account Token Creator role on the target service account, and grant the target service account the specific resource permissions (Secret Manager Secret Accessor).
To establish service account impersonation, the calling principal (`[email protected]`) needs `roles/iam.serviceAccountTokenCreator` specifically on the target service account resource (`[email protected]`). In addition, the target service account itself must hold the required role (`roles/secretmanager.secretAccessor`) to perform the intended workload operation.
Step-by-Step Solution
Key Concept
Service Account Impersonation requires binding the Service Account Token Creator role on the target service account to the calling identity, while assigning necessary resource access roles to the target service account itself.