Examkin

Question

Difficulty: MediumSecrets Management and Service Account Lifecycle Security

A retail platform processes customer transactions using microservices running on Compute Engine instances located in a Google Cloud project named `prod-compute`. The application needs to retrieve database credentials stored securely in Secret Manager located within a central security project named `prod-security`. As a Cloud Architect, you must configure authentication and authorization between the microservices and Secret Manager in accordance with Google-recommended security best practices and the principle of least privilege, while avoiding service account keys. Which strategy should you implement?

  1. Create a dedicated service account in `prod-compute`, attach it to the Compute Engine instances, and grant that service account the Secret Manager Secret Accessor role on the specific database secret in `prod-security`.Answer
  2. B
    Generate a JSON service account key for a service account in `prod-security` with Secret Manager Secret Accessor permissions, and download the key file directly onto the Compute Engine instances.
  3. C
    Grant the Service Account Admin role to the default Compute Engine service account in `prod-compute` so it can manage service accounts and retrieve access tokens from `prod-security`.
  4. D
    Grant the Editor primitive role on the `prod-security` project to the Compute Engine default service account in `prod-compute`.

Answer

Create a dedicated service account in the compute project, attach it to the Compute Engine instances, and grant that service account the Secret Manager Secret Accessor role on the specific database secret in the security project.
The Google-recommended practice for accessing Secret Manager secrets across projects is to attach a dedicated custom service account to the compute workload and grant that service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) specifically on the target secret resource in the security project. Compute Engine workloads leverage Application Default Credentials (ADC) to obtain short-lived access tokens automatically without managing service account JSON key files.

Step-by-Step Solution

1
Define compute workload identity
Create a dedicated, custom service account in `prod-compute` specifically for the transaction processing microservices.
Attaching a dedicated custom service account avoids using default service accounts with overly broad permissions.
2
Configure cross-project resource permission
Grant `roles/secretmanager.secretAccessor` on the specific secret resource in `prod-security` to the custom service account.
Enforces least privilege at the individual secret level without granting project-wide read permissions.
3
Authenticate workloads keylessly
Allow Compute Engine workloads to automatically acquire credentials via Application Default Credentials (ADC) using the attached service account.
Eliminates the risk of managing static service account JSON keys and long-lived credential leakage.

Key Concept

Cross-Project Secret Access with Least Privilege and Application Default Credentials
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic