Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

An enterprise security policy requires that an external automated CI/CD pipeline operating outside of Google Cloud deploy infrastructure into a project named `prod-app-services`. To eliminate security risks associated with long-lived credentials, a cloud administrator creates a dedicated deployment service account named `[email protected]` and configures Workload Identity Federation. Which IAM role configuration should the administrator apply to grant the external workload permission to act as the service account while following Google Cloud security best practices?

  1. Grant the external workload identity principal the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) directly on the deployer-sa service account resource.Answer
  2. B
    Create and export a Service Account JSON private key for deployer-sa and store the key securely in the external CI/CD pipeline's secret variables.
  3. C
    Assign the primitive Editor role to the external workload identity at the project level so it has complete control to manage and use service account credentials.
  4. D
    Grant the Service Account User role (roles/iam.serviceAccountUser) to the external workload identity at the Organization resource level, relying on project-level policy inheritance to restrict usage to deployer-sa.

Answer

Grant the external workload identity principal the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) directly on the deployer-sa service account resource.
Granting the Service Account Token Creator role directly on the specific target service account allows the external workload identity to mint short-lived tokens for that exact account via Workload Identity Federation. This satisfies security requirements by maintaining a keyless authentication architecture while enforcing least privilege resource scoping.

Step-by-Step Solution

1
Identify authentication and authorization security requirements
Workload Identity Federation allows external workloads to exchange external tokens for GCP short-lived tokens via service account impersonation.
Eliminating static, long-lived JSON keys is a core Google Cloud security best practice.
2
Determine the required IAM role for generating short-lived credentials
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) permits a principal to mint OAuth 2.0 access tokens and ID tokens by impersonating the target service account.
Service Account User allows attaching accounts to resources, whereas Token Creator allows direct token generation/impersonation.
3
Apply resource-level scoping following the principle of least privilege
Bind the role directly on the specific service account resource (deployer-sa) rather than at the project or organization level.
Restricting the role binding to the targeted service account prevents the pipeline from impersonating other service accounts in the project.

Key Concept

Service Account Impersonation & Workload Identity Least Privilege
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic