Examkin

Question

Difficulty: HardAutomating Continuous Deployment Pipelines and Release Strategies

An enterprise fintech organization is designing an automated continuous deployment pipeline using Cloud Build and Google Cloud Deploy to release microservices across multiple Google Kubernetes Engine (GKE) clusters. To comply with regulatory security auditing and zero-trust policies, the organization mandates that deployment pipelines must eliminate long-lived service account keys and adhere strictly to the principle of least privilege. The build runner service account requires authorization to execute deployment actions on behalf of a dedicated deployment service account without gaining overall administrative privileges. Which IAM configuration strategy should the cloud architect implement to fulfill these requirements securely?

  1. Grant the build runner service account the Service Account User role (`roles/iam.serviceAccountUser`) on the specific deployment service account to allow identity impersonation.Answer
  2. B
    Grant the build runner service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) at the project level to ensure full privilege delegation during pipeline execution.
  3. C
    Grant the build runner service account the primitive Owner role (`roles/owner`) at the project level to prevent IAM authorization failures during pipeline execution.
  4. D
    Configure the pipeline runner to generate and save temporary service account keys to local ephemeral runner storage for authentication during deployment phases.

Answer

Grant the build runner service account the Service Account User role (`roles/iam.serviceAccountUser`) on the specific deployment service account to allow identity impersonation.
The option specifying to grant the Service Account User role (`roles/iam.serviceAccountUser`) on the specific deployment service account allows the build agent to impersonate the target deployment identity securely. This pattern avoids exported key files and adheres strictly to the principle of least privilege required in enterprise release pipelines.

Step-by-Step Solution

1
Analyze security and governance requirements for automated CI/CD pipeline execution.
Identified the requirement to execute deployments under a dedicated identity without creating long-lived service account keys or over-granting administrative roles.
Enterprise compliance requires strict adherence to the principle of least privilege and short-lived credentials.
2
Evaluate Google Cloud IAM mechanisms for service account identity delegation.
Determined that service account impersonation allows one identity (the build runner) to act on behalf of another target identity (the deployment service account).
Impersonation eliminates the need for exported JSON keys and maintains full auditability in Cloud Audit Logs.
3
Identify the minimum required IAM role for service account impersonation.
Selected the Service Account User role (`roles/iam.serviceAccountUser`) scoped specifically to the deployment service account.
This permission permits the runner to attach or impersonate the target identity without conferring administrative privileges over service accounts.

Key Concept

Service Account Impersonation and Least Privilege in CI/CD Pipelines
Estimated Time:2m 0s
Rate this question

Topics

Automating Continuous Deployment Pipelines and Release Strategies