Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

A developer needs to run a local database migration script that connects to a Google Cloud resource using a dedicated service account, `[email protected]`. To follow security policies that strictly prohibit saving service account JSON keys on local workstations, the cloud administrator wants to grant the developer permission to perform service account impersonation using the gcloud CLI.

Which IAM role must be assigned to the developer's user account on the target service account to allow short-lived identity impersonation?

  1. Service Account Token Creator (`roles/iam.serviceAccountTokenCreator`)Answer
  2. B
    Service Account User (`roles/iam.serviceAccountUser`)
  3. C
    Service Account Key Admin (`roles/iam.serviceAccountKeyAdmin`) to generate and download a JSON key file
  4. D
    Viewer (`roles/viewer`) at the project resource level

Answer

Assign the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) to the developer's user identity on the target service account.
To impersonate a service account and mint short-lived tokens via gcloud CLI or APIs, the initiating identity requires the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account. This allows keyless authorization without exporting JSON keys.

Step-by-Step Solution

1
Identify the mechanism required for keyless short-lived credential generation
Determine that service account impersonation generates temporary OAuth 2.0 access tokens.
Security guidelines require avoiding stored long-lived JSON service account keys on local devices.
2
Evaluate GCP IAM roles specific to service account impersonation
Identify `roles/iam.serviceAccountTokenCreator` as the role providing `iam.serviceAccounts.getAccessToken` and related token generation permissions.
The `roles/iam.serviceAccountUser` role only permits attaching service accounts to compute resources, whereas `roles/iam.serviceAccountTokenCreator` permits generating impersonation tokens.
3
Apply principle of least privilege at the resource level
Grant `roles/iam.serviceAccountTokenCreator` directly on the target service account resource.
Granting the role on the specific service account limits impersonation scope strictly to `[email protected]`.

Key Concept

Configuring Service Account Impersonation using Service Account Token Creator role
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic