Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise DevOps team is setting up an automated CI/CD pipeline using Cloud Build to provision cloud infrastructure via Terraform. To adhere to security governance, the build execution must run using a dedicated deployment service account with minimal IAM privileges rather than elevated project-level permissions. Which IAM role configuration should you implement to allow the Cloud Build service account to act as the deployment service account?

  1. A
    Grant the Service Account User role (roles/iam.serviceAccountUser) on the Cloud Build service account to the deployment service account.
  2. Grant the Service Account User role (roles/iam.serviceAccountUser) to the Cloud Build service account on the deployment service account resource.Answer
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the Cloud Build service account at the project level.
  4. D
    Grant the Editor primitive role (roles/editor) to the Cloud Build service account at the project level.

Answer

Grant the Service Account User role (roles/iam.serviceAccountUser) to the Cloud Build service account on the specific deployment service account resource.
To allow a CI/CD build runner such as Cloud Build to impersonate a dedicated deployment identity, the Cloud Build service account must be granted the Service Account User role directly on the deployment service account resource. This provides the minimum privilege required to execute jobs under that identity.

Step-by-Step Solution

1
Determine the identity initiating the pipeline execution and the target identity needed for deployment.
Cloud Build runs using its service account, which needs to attach or act as a dedicated deployment service account.
Separating build triggers from execution service accounts enforces security boundary controls.
2
Identify the minimum necessary role for service account impersonation.
The Service Account User role (`roles/iam.serviceAccountUser`) allows an identity to impersonate or attach a specified service account.
This role grants usage permissions without providing administrative controls over the service account lifecycle.
3
Apply the role binding at the specific service account resource level.
The Cloud Build service account is granted `roles/iam.serviceAccountUser` directly on the target deployment service account.
Binding at the resource level restricts usage rights exclusively to the designated service account.

Key Concept

Least Privilege IAM Service Account Impersonation in Pipeline Automation
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic