Examkin

Question

Difficulty: Very hardSecrets Management and Service Account Lifecycle Security

An enterprise architecture team is designing an automated secret rotation pipeline in Google Cloud for database credentials stored in Secret Manager. The secret payload is encrypted using a Customer-Managed Encryption Key (CMEK) hosted in Cloud KMS. Rotation must occur automatically every 30 days via a Cloud Run microservice triggered by Secret Manager rotation notifications sent to Cloud Pub/Sub. Enterprise compliance policy strictly forbids long-lived service account JSON keys and mandates least-privilege access controls across all services. Which architectural configuration correctly satisfies these operational and security requirements?

  1. Grant the Cloud Run service account the Secret Manager Secret Accessor and Secret Manager Version Manager roles on the target secret, grant the Cloud SQL Client role on the database instance, and grant the Cloud KMS CryptoKey Decrypter role to the Secret Manager Service Agent. Configure Pub/Sub to trigger Cloud Run using OIDC authentication tied to a dedicated Pub/Sub service account.Answer
  2. B
    Grant the Cloud Run service account the Editor primitive role at the GCP project level, and grant the developer executing the deployment the Service Account Admin role so they can generate temporary service account JSON keys for Cloud Run to access Cloud SQL and Secret Manager.
  3. C
    Generate a service account key for a central administrative service account holding Service Account User and Service Account Admin roles, store the JSON key inside Secret Manager, and mount it into the Cloud Run container volume to perform database password rotation.
  4. D
    Configure Customer-Supplied Encryption Keys (CSEK) for the Secret Manager secret payload instead of CMEK, and rely exclusively on Secret Manager IAM permissions without configuring access grants for the Secret Manager Service Agent or setting up VPC Service Controls.

Answer

The optimal configuration grants fine-grained predefined roles (Secret Accessor, Version Manager, Cloud SQL Client) to the Cloud Run service account, delegates CMEK decryption permissions to the Secret Manager Service Agent, and uses Pub/Sub push authentication with OIDC tokens.
The solution implementing fine-grained predefined roles (Secret Manager Secret Accessor, Secret Manager Version Manager, and Cloud SQL Client) directly on the Cloud Run service account enforces strict least privilege. Granting Cloud KMS Decrypter rights to the Secret Manager Service Agent enables native CMEK support for secret versions. Utilizing Pub/Sub push subscriptions with OIDC token service account authentication enables secure, passwordless execution without generating service account JSON keys.

Step-by-Step Solution

1
Analyze Service Account Identity & Least Privilege
Cloud Run requires fine-grained roles (Secret Accessor, Version Manager, Cloud SQL Client) bound directly to the resource level, avoiding project-wide primitive roles or key generation.
Adheres to security governance requiring minimal access boundaries without service account key creation.
2
Configure CMEK Encryption Key Access
Grant `roles/cloudkms.cryptoKeyDecrypter` on the Cloud KMS key to the automated Secret Manager Service Agent (`service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com`).
Secret Manager manages CMEK envelope encryption operations asynchronously through its dedicated service agent.
3
Configure Secure Trigger Authentication
Set up Secret Manager rotation to publish events to Pub/Sub, and configure a Pub/Sub push subscription with an OIDC token specifying the target Cloud Run service account.
Ensures authenticated microservice invocations over HTTPS without embedding static credentials.

Key Concept

Secret Manager CMEK Integration and Service Account Lifecycle Security
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic