A security architect needs to configure secure, keyless developer access to GCP Secret Manager across Google Cloud projects. The compliance policy strictly prohibits generating or downloading external JSON service account keys. Place the steps required to establish secure service account impersonation for short-lived credential generation in the correct logical sequence.
- 1Create a dedicated target Service Account in the production project hosting Secret Manager.
- 2Grant the target Service Account the Secret Manager Secret Accessor role on the specific secrets.
- 3Grant the developer user group the Service Account Token Creator role on the target Service Account.
- 4Configure developer local application default credentials (ADC) using gcloud CLI with the service account impersonation flag.
Answer
The correct operational sequence begins by defining the target service account identity, configuring least-privilege access permissions on Secret Manager resources, assigning the Service Account Token Creator role to developer user principals, and finally configuring application client tools to impersonate the service account via short-lived credentials.
The valid sequence establishes infrastructure identity first (target service account creation), applies least-privilege authorization to the Secret Manager resources next, assigns short-lived token generation permissions (Token Creator role) on the service account identity to user groups, and lastly configures the local developer execution environment to request impersonated credentials.
Step-by-Step Solution
Key Concept
Service Account Impersonation and Short-Lived Credentials Lifecycle Security