Examkin

Question

Difficulty: Very hardAdvising Development and Operation Teams

An enterprise operations team is preparing to deploy an automated deployment daemon on Google Compute Engine virtual machine instances to provision cloud infrastructure resources and manage application releases to Google Kubernetes Engine (GKE) clusters across multiple GCP projects. The lead developer suggests using the Compute Engine default service account and granting it the primitive Owner role (`roles/owner`) at the GCP folder level to eliminate permission errors during automated resource provisioning. To align with Google Cloud architectural security best practices and the principle of least privilege while maintaining operational efficiency, which guidance should you provide to the development and operations teams?

  1. Recommend creating a dedicated user-managed service account for the deployment daemon, attaching it to the Compute Engine instances, configuring Workload Identity for GKE deployments, and granting fine-grained predefined IAM roles scoped to the specific target projects.Answer
  2. B
    Recommend retaining the Compute Engine default service account on the VM instances and assigning the primitive Owner role (`roles/owner`) at the folder level to streamline cross-project deployment authorization.
  3. C
    Recommend assigning the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the deployment daemon across all target projects so it can manage and impersonate any workload service account without needing granular IAM permissions.
  4. D
    Recommend generating a downloadable service account JSON key file, embedding the key directly into the deployment daemon configuration file stored on the VM boot disk, and scheduling a manual key rotation process every quarter.

Answer

Advise the team to create a dedicated user-managed service account attached to the Compute Engine instances, use Workload Identity for GKE integrations, and grant fine-grained, minimum-required predefined IAM roles scoped strictly to target projects.
The architect should advise creating a dedicated, user-managed service account attached to the Compute Engine deployment instances. Using Workload Identity allows GKE workloads to securely interact with Google Cloud APIs using short-lived tokens without storing credentials. Granting fine-grained predefined roles at the project level strictly satisfies the principle of least privilege while keeping management overhead low.

Step-by-Step Solution

1
Analyze identity requirements for automated workloads on Compute Engine and GKE.
Identified that default service accounts contain excessive default access or primitive roles that breach compliance.
Default service accounts should not be used in enterprise production deployment pipelines.
2
Evaluate authentication and credential management mechanisms.
Determined that service account keys should be avoided in favor of VM metadata tokens and Workload Identity.
Workload Identity and attached service accounts use short-lived, automatically rotated tokens without long-lived key risks.
3
Select least-privilege IAM roles scoped to the appropriate resource boundaries.
Configured fine-grained predefined roles at the project level instead of primitive roles at the folder level.
Predefined roles restrict permissions to only what is strictly necessary for deployment pipelines.

Key Concept

Workload Identity and Least Privilege IAM Architecture for CI/CD Deployment Services
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic