Examkin

Question

Difficulty: HardProgrammatic GCP Interaction via SDK, CLI, and APIs

A platform engineering team is deploying a Python application in an on-premises container environment. The application needs to programmatically create and manage resources across multiple Google Cloud projects using Google Cloud Client Libraries. Enterprise security policy strictly forbids downloading service account JSON key files and mandates short-lived credentials alongside fine-grained authorization. Which TWO configuration steps should the team implement to establish secure programmatic interaction with Google Cloud APIs?

  1. Set up Workload Identity Federation using an on-premises OpenID Connect (OIDC) identity provider to allow the application to exchange short-lived federated tokens for Google Cloud service account tokens.Answer
  2. Initialize the Google Cloud Client Libraries using standard application code patterns that rely on Application Default Credentials (ADC) to auto-detect credential sources from the execution environment.Answer
  3. C
    Generate a service account JSON key file, encode it as a base64 string, and inject it directly into the application container environment variables.
  4. D
    Grant the service account the primitive Owner role (`roles/owner`) at the organization node level to guarantee uninterrupted programmatic access across all current and future projects.

Answer

The team should configure Workload Identity Federation using an on-premises OIDC identity provider for short-lived token exchange and initialize the Google Cloud Client Libraries using Application Default Credentials (ADC) for seamless credential discovery.
The combination of Workload Identity Federation and Application Default Credentials provides keyless authentication for on-premises container workloads. Workload Identity Federation trades external OIDC tokens for short-lived Google Cloud service account tokens, while ADC allows SDK client libraries to automatically discover and use those short-lived credentials without hardcoded configuration.

Step-by-Step Solution

1
Establish federated identity trust with Google Cloud IAM
Configured Workload Identity Pool and Provider to trust external OIDC identity tokens.
Allows external workloads to authenticate programmatically without requiring downloadable service account keys.
2
Configure application environment for token exchange
Created a credential configuration file specifying the Workload Identity provider details and target service account.
Enables Application Default Credentials (ADC) to automatically exchange external tokens for short-lived Google Cloud access tokens.
3
Instantiate client libraries using implicit ADC loading
Client libraries automatically pick up credentials from the ADC environment location without hardcoded parameters.
Ensures clean, maintainable, and secure programmatic GCP interaction compliant with enterprise governance.

Key Concept

Programmatic GCP API authentication using Workload Identity Federation and Application Default Credentials (ADC)
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic