Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

A security audit workload needs to periodically list and view all user-managed service accounts and their associated keys within a Google Cloud project named `corp-analytics-prod`. The workload must be granted only the minimum necessary permissions to view service account configurations without the ability to create, delete, modify, or impersonate any service account. Following Google Cloud security best practices and the principle of least privilege, which action should you take?

  1. Create a dedicated service account for the workload and grant it the predefined `roles/iam.serviceAccountViewer` role on the project.Answer
  2. B
    Create a dedicated service account for the workload and grant it the primitive `roles/viewer` role on the project.
  3. C
    Create a dedicated service account, grant it the `roles/iam.serviceAccountAdmin` role at the project level, and define a deny policy at the folder level to restrict modification actions.
  4. D
    Create a dedicated service account, grant it the `roles/iam.serviceAccountKeyAdmin` role on the project, and download a service account JSON key file for local authentication.

Answer

Create a dedicated service account for the workload and grant it the predefined `roles/iam.serviceAccountViewer` role on the project.
The correct option grants the predefined role `roles/iam.serviceAccountViewer` to the dedicated service account. This predefined role includes the specific read-only permissions (`iam.serviceAccounts.get`, `iam.serviceAccounts.list`, `iam.serviceAccountKeys.get`, `iam.serviceAccountKeys.list`) required to audit service account configurations while preventing any modifications, key creations, or impersonation actions.

Step-by-Step Solution

1
Identify the specific access requirements for the workload.
The workload requires read-only access to inspect service accounts and service account keys in the project, with no management or impersonation rights.
Security guidelines dictate granting only the exact permissions needed to perform the required task.
2
Evaluate Google Cloud Identity and Access Management (IAM) roles against the least privilege principle.
The `roles/iam.serviceAccountViewer` role provides permissions such as `iam.serviceAccounts.list`, `iam.serviceAccounts.get`, and `iam.serviceAccountKeys.list` without administrative or execution rights.
Predefined IAM roles target specific resource permissions better than broad primitive roles like Viewer or administrative roles.
3
Select the appropriate role assignment.
Assigning `roles/iam.serviceAccountViewer` to the dedicated service account at the project level fulfills the auditing requirement securely.
This enforces least privilege while satisfying all inspection requirements.

Key Concept

Least Privilege Service Account Management
Estimated Time:1m 30s
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic