Examkin

Question

Difficulty: MediumProgrammatic GCP Interaction via SDK, CLI, and APIs

A platform engineer needs to configure a software developer's local environment to run Python scripts that programmatically manage Google Cloud Storage buckets using Google Cloud Client Libraries. Enterprise security policy strictly prohibits downloading JSON service account keys. The scripts must run using the identity and permissions of a target service account. Place the operational steps in the correct chronological sequence to establish secure programmatic access via Application Default Credentials (ADC) with service account impersonation.

  1. 1Grant the developer's user account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account.
  2. 2Run 'gcloud auth login' on the developer workstation to authenticate the developer's user identity with Google Cloud.
  3. 3Run 'gcloud auth application-default login --impersonate-service-account=[SA_EMAIL]' to create local Application Default Credentials.
  4. 4Instantiate the Google Cloud Client Library in Python code relying on standard credentials discovery without passing key paths.

Answer

The correct sequence begins with granting the user identity the Service Account Token Creator role on the target service account, followed by authenticating the user session via gcloud auth login, generating local ADC with impersonation using gcloud auth application-default login --impersonate-service-account, and finally running Python code that initializes Google Cloud Client Libraries using standard ADC auto-discovery.
To enable secure local programmatic interaction with GCP APIs without downloading key files, IAM impersonation permissions must first be granted via the Service Account Token Creator role on the target service account. The developer then logs in with user credentials using gcloud auth login. Next, Application Default Credentials (ADC) are configured with impersonation via gcloud auth application-default login --impersonate-service-account. Finally, the Python application code initializes Google Cloud Client Libraries using standard ADC detection, executing securely under the target service account identity.

Step-by-Step Solution

1
Assign the Service Account Token Creator IAM role on the target service account
The developer identity acquires permission to generate tokens on behalf of the service account
Service account impersonation requires explicit token creation permissions granted on the target service account resource.
2
Authenticate user credentials with gcloud auth login
An active user credential session is stored locally for gcloud CLI operations
gcloud requires an authenticated principal session to authorize token exchange requests for service account impersonation.
3
Generate local ADC configured for service account impersonation
Application Default Credentials file is written referencing the impersonated service account email
Executing gcloud auth application-default login with the --impersonate-service-account flag configures the local ADC configuration for seamless SDK consumption.
4
Initialize Google Cloud Client Library in application code
The application makes API calls authorized under the target service account identity without downloading private keys
Google Cloud SDK client libraries automatically locate the ADC configuration file and handle short-lived token requests behind the scenes.

Key Concept

Application Default Credentials (ADC) with Service Account Impersonation
Estimated Time:2m 0s
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic