Examkin

Soru

Zorluk: KolayConfiguring Service Account Impersonation and Workload Identity

An enterprise application running locally on a developer's workstation needs temporary access to Google Cloud resources using a dedicated service account. To follow Google Cloud security best practices, you want to enable service account impersonation without creating long-lived credentials. Which IAM role must be granted to the developer on the target service account?

  1. Service Account Token Creator (roles/iam.serviceAccountTokenCreator)Cevap
  2. B
    Service Account Key Admin (roles/iam.serviceAccountKeyAdmin) to generate and download a JSON private key file
  3. C
    Owner (roles/owner) at the project level to provide full control over all service account operations
  4. D
    Organization Admin (roles/resourcemanager.organizationAdmin) at the organization level so permissions inherit downward to all service accounts

Cevap

The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) granted directly on the target service account enables impersonation and generation of short-lived credentials without key file export.
Granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account provides the user with permission to impersonate the service account and generate short-lived credentials. This approach follows Google Cloud security best practices by avoiding long-lived JSON service account keys.

Adım Adım Çözüm

1
Identify the requirement for keyless short-lived credential delegation (impersonation).
Recognize that service account impersonation is preferred over exporting long-lived service account JSON keys.
Impersonation eliminates the security risks associated with storing key files on local developer machines.
2
Determine the minimal predefined IAM role required for impersonation.
Select the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator).
This role grants permission to create short-lived OAuth2 access tokens, ID tokens, and signed blobs on behalf of the service account.
3
Apply the principle of least privilege by binding the role to the specific service account resource.
Grant the role directly to the developer's identity on the target service account.
Binding at the resource level restricts impersonation capabilities strictly to the required service account.

Anahtar Kavram

Service Account Impersonation
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru