Examkin

Question

Difficulty: EasySecrets Management and Service Account Lifecycle Security

You need to configure secure, keyless authentication for an external GitHub Actions CI/CD pipeline accessing Google Cloud resources using Workload Identity Federation. What is the correct sequence of steps to establish this setup?

  1. 1Create a Google Cloud Service Account and assign it the minimum necessary IAM roles required for the deployment tasks.
  2. 2Create a Workload Identity Pool and configure an OIDC Provider mapped to GitHub's issuer URL.
  3. 3Grant the GitHub repository principal the Workload Identity User role (roles/iam.workloadIdentityUser) on the target Service Account.
  4. 4Configure the GitHub Actions workflow step to authenticate via the Workload Identity Provider and obtain short-lived Google Cloud access tokens.

Answer

The correct sequence starts with creating the target GCP Service Account with minimal IAM roles, creating the Workload Identity Pool and Provider for GitHub, granting the external GitHub principal the Workload Identity User role on the service account, and finally configuring the CI/CD workflow to request short-lived tokens.
Configuring Workload Identity Federation requires defining the target GCP Service Account first, establishing the Workload Identity Pool and OIDC Provider, granting the Workload Identity User role to authorize impersonation by the external identity, and lastly configuring the external workload to exchange tokens.

Step-by-Step Solution

1
Define target identity in GCP
A service account exists with specific permissions granted for resource deployment.
Before configuring external authentication, the target GCP resource identity and its permissions must be defined.
2
Establish external trust infrastructure
Workload Identity Pool and OIDC Provider are configured to recognize tokens from GitHub.
Google Cloud must be configured to trust token assertions from the external identity provider.
3
Authorize impersonation
The external principal is granted the Workload Identity User role on the target service account.
Impersonation rights must be granted so the validated external identity is allowed to act as the GCP service account.
4
Exchange tokens in CI/CD pipeline
Short-lived GCP credentials are used during workflow execution.
The pipeline uses its native OIDC token to request temporary GCP federated credentials.

Key Concept

Workload Identity Federation for keyless authentication
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic