Examkin

Question

Difficulty: EasyProgrammatic GCP Interaction via SDK, CLI, and APIs

You need to configure your local development environment to authenticate programmatic interactions with Google Cloud APIs using Application Default Credentials (ADC) via service account impersonation, avoiding the use of long-lived downloaded service account keys. In what sequence should you execute these configuration steps?

  1. 1Authenticate to the Google Cloud CLI using your individual user identity by executing `gcloud auth login`.
  2. 2Grant your user account the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account.
  3. 3Acquire local Application Default Credentials with impersonation enabled by executing `gcloud auth application-default login --impersonate-service-account=TARGET_SERVICE_ACCOUNT`.

Answer

The correct sequence begins by authenticating your user identity (`gcloud auth login`), granting your identity the Service Account Token Creator role on the service account, and finally generating Application Default Credentials configured with service account impersonation (`gcloud auth application-default login --impersonate-service-account`).
To establish secure local programmatic access using Application Default Credentials without downloading long-lived keys, you must first authenticate your user identity, ensure your identity holds the Service Account Token Creator role on the target service account, and then generate ADC with the impersonation flag active.

Step-by-Step Solution

1
Authenticate user identity.
Establishes active user credentials in the local Google Cloud CLI context.
Impersonation requires an existing authenticated primary principal to initiate token requests.
2
Assign the Service Account Token Creator IAM role.
Grants permission for the user identity to generate short-lived tokens for the service account.
Without `roles/iam.serviceAccountTokenCreator`, API calls requesting impersonated credentials will fail authorization checks.
3
Generate Application Default Credentials (ADC) with impersonation.
Writes a local ADC credentials file configured to mint temporary service account access tokens automatically.
This allows client SDKs using ADC to authenticate securely as the service account without exposing static JSON key files.

Key Concept

Programmatic GCP SDK Authentication using Application Default Credentials (ADC) and Service Account Impersonation
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic