An organization is designing a credential management policy for microservices running on Google Cloud Compute Engine instances. Which of the following security practices should be implemented to enforce Google Cloud least privilege and service account lifecycle security recommendations? (Select TWO.)
- Attach dedicated service accounts to the Compute Engine instances to utilize short-lived automatic credentials instead of generating static service account JSON keys.Answer
- Store third-party API credentials in Secret Manager and grant the workload's service account the Secret Manager Secret Accessor role.Answer
- CAssign the primitive Owner role to the instance service account to prevent permission denial issues across project resources.
- DGrant developers the Service Account Admin role when they only need to deploy resources that run under a specific service account identity.
Answer
The recommended security practices are attaching dedicated service accounts to compute instances to leverage short-lived credentials (avoiding static JSON keys) and storing sensitive credentials in Secret Manager with fine-grained Secret Accessor role permissions.
Attaching service accounts directly to compute instances eliminates static key exposure, while storing sensitive API keys in Secret Manager and binding the Secret Accessor role adheres strictly to least-privilege access principles.
Step-by-Step Solution
Key Concept
Secrets Management and Service Account Lifecycle Security