Examkin

Question

Difficulty: HardProgrammatic GCP Interaction via SDK, CLI, and APIs

An enterprise security policy prohibits the use of downloadable JSON service account keys on developer workstations. A developer needs to run a local Python application that uses Google Cloud Client Libraries to query BigQuery tables in Project-B using a target service account (`[email protected]`).

Arrange the following operational steps in the correct chronological order to configure local credentials and execute the application using Google Cloud best practices for service account impersonation.

  1. 1Authenticate the developer's user identity to the Google Cloud CLI using `gcloud auth login`.
  2. 2Grant the developer's user identity the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on `[email protected]`.
  3. 3Generate local Application Default Credentials (ADC) configured with impersonation using `gcloud auth application-default login --impersonate-service-account=sa-b@project-b.iam.gserviceaccount.com`.
  4. 4Execute the Python application utilizing the standard Google Cloud Client Library for BigQuery.

Answer

The correct workflow starts by authenticating the developer's identity with gcloud auth login, granting the Service Account Token Creator role on the target service account, initializing Application Default Credentials (ADC) with the service account impersonation flag, and finally executing the Python SDK application.
Proper setup of programmatic GCP interaction using service account impersonation requires authenticating the user identity first, delegating token creation privileges via roles/iam.serviceAccountTokenCreator on the target service account, generating impersonated Application Default Credentials locally, and finally running the SDK code which seamlessly picks up the ADC credentials.

Step-by-Step Solution

1
Authenticate user identity
Initializes active user credentials in gcloud CLI.
Service account impersonation requires an authenticated user identity to authorize the token generation request.
2
Assign IAM Token Creator role
User receives permission to impersonate the target service account.
Without roles/iam.serviceAccountTokenCreator granted on the service account, the gcloud ADC impersonation call will fail with a 403 Forbidden error.
3
Create impersonated Application Default Credentials
Creates a local ADC credential file pointing to the target service account.
Application Default Credentials allow Google Cloud Client Libraries to transparently acquire short-lived tokens without storing permanent keys.
4
Run the SDK application
Application authenticates as sa-b and successfully queries BigQuery.
Client libraries automatically resolve ADC from default environment paths and handle token lifecycle management implicitly.

Key Concept

Service account impersonation and Application Default Credentials (ADC) configuration
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic