Examkin

Question

Difficulty: HardProgrammatic GCP Interaction via SDK, CLI, and APIs

An enterprise DevOps team is setting up an automated CI/CD pipeline on a self-hosted runner outside of Google Cloud. The deployment script needs to programmatically execute gcloud CLI commands and custom Python client library scripts to manage infrastructure across multiple target Google Cloud projects. Enterprise security policy strictly prohibits creating, downloading, or storing long-lived service account JSON keys. Which approach should the Cloud Architect recommend to enable secure, programmatic authentication for the pipeline?

  1. Authenticate the runner using Workload Identity Federation to obtain short-lived credentials for a baseline service account, and use service account impersonation for target project deployments.Answer
  2. B
    Generate service account JSON keys for each target project service account, store them in the pipeline's secret manager, and set GOOGLE_APPLICATION_CREDENTIALS during execution.
  3. C
    Grant the primitive Owner role across all target projects to a single runner service account authenticated via a long-lived OAuth2 refresh token.
  4. D
    Cache authenticated gcloud user tokens and unversioned configuration state files on the local filesystem of the runner to persist access across job runs.

Answer

Authenticate the runner using Workload Identity Federation to obtain short-lived credentials for a baseline service account, and use service account impersonation for target project deployments.
The correct approach leverages Workload Identity Federation (WIF) alongside service account impersonation. WIF enables on-premises or external CI/CD workloads to authenticate with Google Cloud using native identity tokens, exchanging them for short-lived GCP access tokens without service account keys. Using service account impersonation (`--impersonate-service-account` in gcloud or `google.auth.impersonate` in SDKs) allows the runner to dynamically assume fine-grained identities across target projects safely.

Step-by-Step Solution

1
Identify authentication constraints
External self-hosted runner requiring programmatic access to multiple GCP projects without using long-lived service account JSON keys.
Security policy forbids static credential files such as service account JSON key pairs.
2
Establish federated identity for non-GCP environment
Configure Workload Identity Federation between the external CI/CD provider and Google Cloud IAM.
Allows short-lived OAuth2 access tokens to be issued based on trusted external identity tokens.
3
Apply short-lived token escalation across projects
Use gcloud --impersonate-service-account or Google Cloud SDK client library impersonation credentials to target specific project roles.
Enables multi-project access dynamically with minimal permissions and short-lived credentials.

Key Concept

Workload Identity Federation and Service Account Impersonation for Keyless Programmatic Interaction
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic