Examkin

Question

Difficulty: MediumAdvising Development and Operation Teams

A cloud architect at an enterprise logistics company is advising a development team on establishing secure deployment practices. The team's automated CI/CD pipeline deploys application workloads onto Compute Engine virtual machines that execute under a dedicated runtime application service account. To enable the CI/CD pipeline identity to attach this runtime service account to newly created virtual machine instances during deployment, developers plan to assign the CI/CD service account the Service Account Admin role. Which recommendation should the architect provide to adhere to Google Cloud security best practices and the principle of least privilege?

  1. Grant the CI/CD pipeline service account the Service Account User role on the specific runtime application service account.Answer
  2. B
    Grant the CI/CD pipeline service account the Service Account Admin role at the project level.
  3. C
    Grant the CI/CD pipeline service account the primitive Editor role across the project.
  4. D
    Migrate the application deployment target to a Google Kubernetes Engine (GKE) cluster to manage service account attachments automatically.

Answer

Grant the CI/CD pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime application service account.
The correct recommendation is to grant the Service Account User role (roles/iam.serviceAccountUser) to the CI/CD pipeline service account on the specific runtime application service account. This allows the pipeline identity to pass the runtime service account to Compute Engine instances without granting administrative privileges to alter service accounts or project IAM policies.

Step-by-Step Solution

1
Analyze the operational permission requirement
The deployment pipeline identity only needs permission to attach (impersonate/use) an existing runtime service account when provisioning compute resources.
Creating or modifying service accounts is not required during standard instance provisioning.
2
Evaluate IAM roles according to least privilege
The Service Account User role (roles/iam.serviceAccountUser) grants the exact permission (iam.serviceAccounts.actAs) necessary to attach the service account to compute instances.
Administrative roles such as Service Account Admin or primitive roles grant overprivileged access.
3
Formulate the architect's recommendation
Advise granting roles/iam.serviceAccountUser scoped specifically to the target runtime service account resource.
Resource-level scoping enforces minimal operational exposure while supporting deployment automation.

Key Concept

Applying Least Privilege with Service Account User Roles in Deployment Pipelines
Estimated Time:1m 30s
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic