Examkin

Question

Difficulty: MediumSecrets Management and Service Account Lifecycle Security

A security architect is configuring keyless authentication for an external CI/CD runner to fetch database credentials stored in GCP Secret Manager. To comply with zero-trust security standards and prevent credential leakage, the architect decides to implement Workload Identity Federation using OpenID Connect (OIDC). What is the correct chronological sequence of administrative steps required to establish keyless authentication and retrieve the secret payload?

  1. 1Create a Workload Identity Pool in Google Cloud IAM to define the management boundary for the external pipeline identities.
  2. 2Add an OIDC Workload Identity Provider to the pool, specifying the issuer URL, audience, and assertion attribute mappings.
  3. 3Provision a dedicated GCP Service Account and grant it the Secret Manager Secret Accessor role on the required secret.
  4. 4Bind the external workload identity principal to the GCP Service Account using the Workload Identity User role.
  5. 5Exchange the external OIDC token for a short-lived GCP access token using the Security Token Service API to fetch the secret payload.

Answer

The correct sequence starts with creating the Workload Identity Pool, adding the OIDC Workload Identity Provider, provisioning a dedicated target Service Account with least privilege, binding the external principal using the Workload Identity User role, and finally exchanging the external OIDC token for a short-lived GCP access token via STS.
The correct order follows the standard setup lifecycle for Workload Identity Federation: first establishing the infrastructure container (Workload Identity Pool), then configuring provider authentication parameters (OIDC Provider), provisioning a target identity with least privilege (Service Account with Secret Accessor role), mapping authorization between the external identity and target identity (Workload Identity User role), and executing runtime short-lived token exchange via STS.

Step-by-Step Solution

1
Establish the federated container by creating a Workload Identity Pool.
Workload Identity Pool is created in the target GCP project.
The pool serves as the trust boundary for external workloads.
2
Configure the OIDC Provider within the Workload Identity Pool.
Google Cloud IAM can validate external JWT assertions against the issuer and audience.
Provider settings enable validation and attribute extraction from third-party tokens.
3
Create the target Service Account and assign the Secret Manager Secret Accessor role.
The Service Account gains granular access to read secret versions without broad project-level permissions.
Adheres to the principle of least privilege.
4
Grant the Workload Identity User role on the Service Account to the external workload principal.
The external OIDC principal is authorized to impersonate the GCP Service Account.
Establishes authorization for token impersonation.
5
Perform runtime token exchange via the Security Token Service (STS) and request the secret payload.
The workload receives a short-lived GCP access token and successfully reads the secret payload.
Completes the keyless authentication workflow securely without long-lived keys.

Key Concept

Workload Identity Federation lifecycle for external keyless authentication to Secret Manager
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic