Examkin

Question

Difficulty: MediumProgrammatic GCP Interaction via SDK, CLI, and APIs

A DevOps engineer needs to configure a local development workstation to run Python scripts that interact programmatically with Cloud Storage APIs using short-lived credentials via Service Account Impersonation. Corporate security policy strictly prohibits downloading JSON service account keys to local workstations. Place the operational steps in the correct chronological order to configure Application Default Credentials (ADC) with service account impersonation.

  1. 1Authenticate the developer's human user identity to Google Cloud using `gcloud auth login`.
  2. 2Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account to the developer's user identity.
  3. 3Run `gcloud auth application-default login --impersonate-service-account=[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com`.
  4. 4Execute the application using standard Google Cloud Client Libraries without setting `GOOGLE_APPLICATION_CREDENTIALS` to a key file.

Answer

The correct sequence for configuring service account impersonation for Application Default Credentials (ADC) is: 1) Authenticate user identity via `gcloud auth login`, 2) Grant the Service Account Token Creator role to the user identity on the target service account, 3) Generate impersonated ADC using `gcloud auth application-default login --impersonate-service-account=...`, and 4) Run the code using standard Google Cloud Client Libraries.
The sequence follows the standard IAM lifecycle for keyless developer access: first establish user identity, grant necessary IAM permissions (`roles/iam.serviceAccountTokenCreator`), configure local ADC for impersonation via the gcloud CLI flag, and finally launch the application code which seamlessly consumes ADC.

Step-by-Step Solution

1
Authenticate user identity
The local environment obtains OAuth tokens for the individual user account.
Before requesting credentials on behalf of another entity, the operator's primary user identity must be authenticated with GCP.
2
Assign IAM impersonation permission
User account gains `roles/iam.serviceAccountTokenCreator` on the target service account resource.
IAM authorization is required to create short-lived OAuth tokens or signed JWTs for a target service account.
3
Generate impersonated ADC local config
Application Default Credentials file `application_default_credentials.json` is updated with impersonation parameters.
Using the `--impersonate-service-account` flag configures ADC to fetch short-lived tokens automatically instead of using static key files.
4
Execute application code with Cloud SDK/Client Libraries
Client libraries load ADC credentials and send API requests signed by the impersonated service account.
Google Cloud Client Libraries default to searching standard ADC paths, enabling secure keyless programmatic access.

Key Concept

Service Account Impersonation with Application Default Credentials (ADC)
Estimated Time:1m 30s
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic