Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

An organization wants to configure a GitHub Actions CI/CD pipeline to deploy Cloud Run services without exporting long-lived service account JSON keys. What is the correct sequential order of steps to establish Workload Identity Federation and service account impersonation for this setup?

  1. 1Create a Workload Identity Pool and Provider in Google Cloud configured for GitHub OIDC.
  2. 2Create a target GCP Service Account with the required IAM roles to manage Cloud Run deployments.
  3. 3Grant the `roles/iam.workloadIdentityUser` role on the GCP Service Account to the specific GitHub repository principal.
  4. 4Configure the GitHub Actions workflow step to authenticate using the Workload Identity Provider and request short-lived credentials.

Answer

The correct sequence begins with creating the Workload Identity Pool and Provider, followed by creating the target GCP Service Account, granting the `roles/iam.workloadIdentityUser` role to the GitHub repository identity on that service account, and lastly updating the workflow step to request short-lived credentials.
Establishing Workload Identity Federation requires creating the federated infrastructure (Pool & Provider), defining the target GCP identity (Service Account), binding the `roles/iam.workloadIdentityUser` role to the external identity principal, and lastly referencing these resources in the pipeline execution workflow.

Step-by-Step Solution

1
Set up the Workload Identity Pool and Provider in GCP
Establishes federated trust between Google Cloud IAM and GitHub's OpenID Connect (OIDC) issuer.
Google Cloud needs a registered pool and provider to validate incoming OIDC assertion tokens from external workloads.
2
Provision the target GCP Service Account with Cloud Run deployment roles
Creates the GCP identity holding minimal privileges required for the deployment.
The external workload cannot execute GCP commands without an authorized target service account to impersonate.
3
Bind `roles/iam.workloadIdentityUser` on the Service Account to the GitHub repository principal
Authorizes the specific external repository identity to assume the target service account.
Impersonation via Workload Identity Federation requires explicit authorization using the Workload Identity User role on the target service account.
4
Configure the GitHub Actions workflow to exchange OIDC tokens for GCP credentials
Enables keyless, short-lived authentication for deployment steps.
The pipeline workflow step uses the official auth action to exchange GitHub tokens for temporary Google Cloud access tokens.

Key Concept

Configuring Workload Identity Federation for keyless service account impersonation from external CI/CD pipelines.
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic