Examkin

Soru

Zorluk: OrtaConfiguring Service Account Impersonation and Workload Identity

A developer needs to execute local gcloud commands to manage Cloud Storage objects on behalf of a target service account, [email protected]. Following Google Cloud security best practices, the developer must temporarily impersonate this service account without downloading static key files. Which IAM configuration correctly enables this service account impersonation?

  1. Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the developer's user identity on the target service account.Cevap
  2. B
    Generate and download a JSON service account key for [email protected] and authenticate using gcloud auth activate-service-account.
  3. C
    Grant the primitive Editor role (roles/editor) to the developer's user identity directly on the target service account resource.
  4. D
    Grant the Storage Admin role to the developer at the project level while revoking all permissions on the service account resource level.

Cevap

Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the developer's user identity on the target service account.
To impersonate a Google Cloud service account, a principal must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on that service account. This allows the principal to create short-lived credentials and act on behalf of the service account without creating or downloading long-lived JSON service account keys.

Adım Adım Çözüm

1
Analyze requirement and security constraints
The requirement is keyless identity delegation (impersonation) for local CLI administration.
GCP security guidelines advise against generating long-lived service account key files.
2
Identify the required IAM permission for identity assumption
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) provides permissions to produce short-lived OAuth 2.0 access tokens for impersonation.
Impersonating a service account relies on token minting capabilities.
3
Determine proper IAM binding scope
Bind the Service Account Token Creator role to the user principal directly on the target service account resource.
Applying the role on the specific service account resource enforces the principle of least privilege.

Anahtar Kavram

Configuring Service Account Impersonation
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru