Examkin

Question

Difficulty: HardProgrammatic GCP Interaction via SDK, CLI, and APIs

An enterprise deployment server running on-premises executes automated bash scripts using the gcloud CLI to manage resources across multiple Google Cloud projects. The enterprise security policy strictly prohibits storing or generating long-lived service account JSON keys on local disk. The scripts must perform management operations under specific workload service accounts residing in each target project. How should the cloud architect configure the gcloud CLI authentication and execution flow to meet these compliance requirements?

  1. Establish Workload Identity Federation to authenticate the on-premises environment with short-lived tokens, and set the gcloud CLI configuration property auth/impersonate_service_account to the target service account email.Answer
  2. B
    Configure the script to programmatically create a temporary service account JSON key using gcloud iam service-accounts keys create before executing commands, and delete the key file immediately upon script completion.
  3. C
    Grant the Owner primitive role directly to the federated external identity across all target projects to bypass the need for service account impersonation.
  4. D
    Export local gcloud authentication and state configuration files to an unversioned directory on the deployment server so all script runs re-use cached identity credentials.

Answer

Establish Workload Identity Federation to authenticate the on-premises environment with short-lived tokens, and set the gcloud CLI configuration property auth/impersonate_service_account to the target service account email.
Combining Workload Identity Federation with gcloud service account impersonation eliminates the need for downloadable service account JSON keys. Workload Identity Federation provides keyless authentication for external workloads, while configuring gcloud auth/impersonate_service_account ensures all CLI operations execute under the security context of the target service account using short-lived credentials.

Step-by-Step Solution

1
Identify key management compliance constraints
Local JSON service account key creation and storage are strictly forbidden by enterprise security policy.
Security governance requires keyless authentication using short-lived tokens.
2
Select keyless authentication mechanism for on-premises environment
Use Workload Identity Federation to federate on-premises credentials with GCP Security Token Service (STS).
Workload Identity Federation enables on-premises workloads to authenticate securely without downloadable service account keys.
3
Configure gcloud CLI service account impersonation
Configure gcloud auth/impersonate_service_account or pass the --impersonate-service-account flag.
This instructs gcloud CLI to automatically generate short-lived OAuth 2.0 access tokens for the target service account via the IAM Service Account Credentials API.

Key Concept

Keyless authentication via Workload Identity Federation and gcloud Service Account Impersonation
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic