An online retail enterprise requires an external auditing system to read data from BigQuery datasets residing inside multiple Google Cloud projects under a dedicated 'Analytics-Prod' folder. Additionally, the external system must be able to generate short-lived credentials by impersonating a specific managed service account without using static service account keys. Which two administrative actions should you take to fulfill these security requirements while strictly adhering to the principle of least privilege?
- Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditing identity at the 'Analytics-Prod' folder level.Answer
- Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) to the auditing identity on the specific target service account resource.Answer
- CGrant the Editor primitive role (`roles/editor`) to the auditing identity at the Organization level.
- DGrant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the auditing identity at the 'Analytics-Prod' folder level.
Answer
Granting the BigQuery Data Viewer role at the 'Analytics-Prod' folder level and assigning the Service Account Token Creator role directly on the target service account resource provides minimal, securely scoped access.
Granting the predefined BigQuery Data Viewer role at the folder level leverages Google Cloud resource hierarchy inheritance to provide read-only access to all datasets in member projects. Granting the Service Account Token Creator role on the specific service account enables secure short-lived token generation for impersonation without sharing static key files or granting excessive service account management permissions.
Step-by-Step Solution
Key Concept
IAM Resource Hierarchy Inheritance and Fine-Grained Service Account Impersonation Roles
Estimated Time:2m 0s