Examkin

Question

Difficulty: MediumAdvising Development and Operation Teams

An enterprise development team is setting up an automated CI/CD pipeline using a deployment service account to provision Compute Engine instances via Terraform. The deployed virtual machines need to run applications under a dedicated runtime service account. The team wants to allow the pipeline service account to attach this runtime service account to the virtual machines without granting excess administrative permissions. Which recommendation should you give to the development team?

  1. Grant the deployment service account the Service Account User role on the dedicated runtime service account.Answer
  2. B
    Grant the deployment service account the Service Account Admin role at the project level.
  3. C
    Grant the deployment service account the Project Editor primitive role.
  4. D
    Store the Terraform state files inside the temporary CI/CD runner local filesystem without persisting them to a Cloud Storage backend.

Answer

Grant the deployment service account the Service Account User role on the dedicated runtime service account.
Granting the Service Account User role (roles/iam.serviceAccountUser) on the specific target service account allows the deployment pipeline to attach that service account to new Compute Engine instances. This fulfills the deployment requirement while adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the required operational capability for the CI/CD deployment service account.
The pipeline needs permission to attach a specific runtime service account to Compute Engine instances.
Security best practices require restricting permission scope to only what is necessary for resource provisioning.
2
Evaluate Google Cloud IAM roles for service account attachment.
The Service Account User role (roles/iam.serviceAccountUser) permits an identity to attach a service account to a compute resource.
This role provides exact functional authorization without granting administrative capabilities over IAM resources.
3
Apply least privilege scoping.
Granting roles/iam.serviceAccountUser at the target service account resource level limits attachment rights strictly to that specific identity.
Resource-level IAM bindings prevent the deployment pipeline from attaching unauthorized service accounts.

Key Concept

Least privilege service account attachment and IAM scoping
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic