An organization enforces a strict security policy prohibiting the creation and storage of long-lived service account JSON keys on Compute Engine instances. A cloud engineer needs to configure an application on a Compute Engine virtual machine in Project A so that it can impersonate a target service account in Project B to read data from a Cloud Storage bucket. Which of the following configuration steps are required to establish this access securely according to Google Cloud best practices? (Select TWO.)
- Grant the Compute Engine VM's attached service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account in Project B.Answer
- Grant the target service account in Project B the Storage Object Viewer role (roles/storage.objectViewer) on the target Cloud Storage bucket.Answer
- CGenerate a long-lived service account JSON key for the target service account in Project B and store it securely in the Compute Engine VM metadata.
- DGrant the Compute Engine VM's attached service account the primitive Owner role (roles/owner) on Project B to enable full cross-project identity delegation.
Answer
The correct configuration steps are to grant the source VM's service account the Service Account Token Creator role on the target service account, and to grant the target service account the Storage Object Viewer role on the target Cloud Storage bucket.
To set up service account impersonation securely, the requesting identity (the VM's attached service account) must be granted the Service Account Token Creator role directly on the target service account. Additionally, the target service account must hold the specific predefined role (Storage Object Viewer) on the Cloud Storage bucket to perform the required operations.
Step-by-Step Solution
Key Concept
Service Account Impersonation and Short-Lived Credentials