Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A biotechnology company manages its Google Cloud workloads within a resource hierarchy containing a dedicated folder named Genomics-Research. An automated CI/CD deployment pipeline running in a separate management project needs to attach and execute jobs as a specific worker service account inside a project under Genomics-Research. The security team mandates adhering strictly to the principle of least privilege while maintaining operational isolation. Which configuration recommended by Google Cloud best practices meets these requirements?

  1. Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific worker service account resource to the deployment pipeline service account.Answer
  2. B
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) on the target project to the deployment pipeline service account.
  3. C
    Grant the Editor primitive role (roles/editor) at the Genomics-Research folder level to the deployment pipeline service account.
  4. D
    Enforce a VPC Service Controls perimeter around the Genomics-Research folder without assigning IAM service account impersonation roles.

Answer

Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific worker service account resource to the deployment pipeline service account.
The optimal Google Cloud security design mandates granting roles at the narrowest resource level possible. Granting the Service Account User role (roles/iam.serviceAccountUser) directly on the specific worker service account gives the deployment pipeline principal exact authorization to impersonate and launch workloads with that identity without granting broader project or folder permissions.

Step-by-Step Solution

1
Identify the minimum necessary permission required for identity impersonation.
The deployment pipeline requires permission to attach/use the target service account to run workloads.
The specific permission required for service account attachment and execution is iam.serviceAccounts.actAs.
2
Determine the resource boundary to apply least privilege.
Apply the role directly to the individual service account resource rather than at the project or folder level.
Resource-level bindings restrict access specifically to the target principal without granting collateral access to other identities in the project or folder hierarchy.
3
Select the appropriate IAM predefined role.
Assign roles/iam.serviceAccountUser to the pipeline identity on the target service account.
This role grants the actAs permission strictly on the designated service account object.

Key Concept

Fine-Grained IAM Service Account Impersonation and Resource Hierarchy Scoping
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy