Examkin

Question

Difficulty: MediumSecrets Management and Service Account Lifecycle Security

An enterprise security team is hardening service account lifecycle management across a multi-project Google Cloud organization. Automated deployment pipelines hosted on an external CI/CD platform currently authenticate using exported long-lived JSON service account keys. The security policy mandates eliminating all long-lived service account keys and preventing project developers from generating new service account keys, while maintaining least-privilege deployment access. Which architectural solution fulfills these security requirements?

  1. Enforce the iam.disableServiceAccountKeyCreation organization policy constraint across the organization hierarchy, and configure Workload Identity Federation to allow the external CI/CD platform to exchange short-lived OIDC tokens for GCP IAM service account tokens.Answer
  2. B
    Grant project developers the Service Account Admin role (roles/iam.serviceAccountAdmin) on the deployment service account, and implement Cloud Pub/Sub with Cloud Functions to rotate the exported JSON service account keys every 90 days.
  3. C
    Assign the Editor primitive role (roles/editor) to the service account, store the service account JSON key in GCP Secret Manager, and configure Customer-Managed Encryption Keys (CMEK) with automatic secret rotation.
  4. D
    Create a VPC Service Controls perimeter around the GCP projects and restrict service account key download requests strictly to authorized internal corporate IP addresses.

Answer

Enforce the iam.disableServiceAccountKeyCreation organization policy constraint across the organization hierarchy, and configure Workload Identity Federation to allow the external CI/CD platform to exchange short-lived OIDC tokens for GCP IAM service account tokens.
Enforcing the 'iam.disableServiceAccountKeyCreation' Organization Policy constraint blocks the creation of service account keys across the GCP resource hierarchy. Paired with Workload Identity Federation, external workloads (such as third-party CI/CD systems) can securely authenticate using short-lived federated credentials directly exchanged with GCP STS, eliminating the operational risks of long-lived JSON keys.

Step-by-Step Solution

1
Analyze security constraints regarding service account key lifecycle.
Identified the requirement to eliminate long-lived exported service account JSON keys completely and block future key creation.
Exported JSON keys pose severe security risks as credentials can be leaked or mismanaged outside Google Cloud.
2
Evaluate key prevention enforcement mechanisms.
Applying the Organization Policy constraint 'iam.disableServiceAccountKeyCreation' globally prevents any identity from creating external service account keys.
Organization policies provide programmatic guardrails across resource hierarchies regardless of individual IAM permissions.
3
Determine the optimal authentication pattern for external CI/CD workloads.
Workload Identity Federation enables keyless authentication by federating external OpenID Connect (OIDC) identity providers with Google Cloud IAM service accounts.
External pipelines can obtain short-lived federated access tokens dynamically without generating or storing persistent credentials.

Key Concept

Service Account Lifecycle Security and Workload Identity Federation
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic