Examkin

Question

Difficulty: MediumSecrets Management and Service Account Lifecycle Security

An organization runs containerized microservices on a Google Kubernetes Engine (GKE) cluster. These microservices need to read data from Google Cloud Storage buckets. Enterprise compliance guidelines strictly prohibit generating, downloading, or storing long-lived service account JSON key files due to the risk of credential leakage. Which architectural solution should you implement to authenticate the GKE workloads against Google Cloud Storage while following Google's recommended security practices?

  1. Enable GKE Workload Identity, bind the Kubernetes service account used by the microservices to a dedicated Google Cloud service account, and grant that Google Cloud service account the Storage Object Viewer role on the required buckets.Answer
  2. B
    Create a dedicated service account key in JSON format, store the key content inside Secret Manager, and configure the application pods to mount the secret volume at runtime.
  3. C
    Enable GKE Workload Identity, create a Google Cloud service account assigned the Editor primitive role at the project level, and map the Kubernetes service account to this service account.
  4. D
    Grant the Service Account Admin role to the GKE node pool's default Compute Engine service account so nodes can dynamically generate short-lived OAuth tokens for pods.

Answer

Enable GKE Workload Identity, bind the Kubernetes service account used by the microservices to a dedicated Google Cloud service account, and grant that Google Cloud service account the Storage Object Viewer role on the required buckets.
The solution using Workload Identity allows Kubernetes service accounts to securely impersonate Google Cloud service accounts without creating, downloading, or managing long-lived service account JSON keys. Granting the Storage Object Viewer role enforces least privilege by giving the microservices only the necessary read permissions on Cloud Storage.

Step-by-Step Solution

1
Identify key security constraints and authentication requirements.
Long-lived Service Account JSON keys are explicitly banned by enterprise policy, ruling out key file generation and mounting.
Workload authentication must use keyless short-lived credential exchange.
2
Select the native GCP identity mechanism for containerized GKE workloads.
GKE Workload Identity enables pods running under a Kubernetes Service Account (KSA) to act as a Google IAM Service Account (GSA).
Workload Identity eliminates the operational overhead and security risk of managing service account keys.
3
Apply least-privilege IAM permissions.
Assign the fine-grained predefined role 'Storage Object Viewer' (roles/storage.objectViewer) to the Google Cloud Service Account specifically on the target buckets.
Primitive roles like Editor or broad administrative roles violate the principle of least privilege.

Key Concept

GKE Workload Identity and Service Account Lifecycle Security
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic