Examkin

Soru

Zorluk: ZorConfiguring Service Account Impersonation and Workload Identity

A security compliance manager at a healthcare organization must allow an external compliance auditing group ([email protected]) to generate short-lived identity tokens to inspect encrypted storage resources using a dedicated service account ([email protected]). To satisfy strict enterprise security policies that prohibit the use of static, long-lived credentials, the team decides to set up service account impersonation. Which configuration step must be performed to enable this impersonation securely?

  1. Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to [email protected] on the compliance-auditor service account resource.Cevap
  2. B
    Generate a new service account JSON key file for [email protected] and share it securely with [email protected].
  3. C
    Grant the primitive Owner role (roles/owner) to [email protected] at the GCP project level to grant full access over service account impersonation APIs.
  4. D
    Assign the Service Account User role (roles/iam.serviceAccountUser) to [email protected] at the project level, assuming that revoking it at the folder level will enforce impersonation.

Cevap

Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the auditor group on the target service account resource.
Service account impersonation relies on short-lived credentials (such as OAuth2 access tokens or OIDC tokens). To grant a user or group the capability to mint tokens on behalf of a target service account, they must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on that target service account.

Adım Adım Çözüm

1
Identify the requirement for short-lived token generation for impersonation.
Determine that keyless delegation requires assigning appropriate token creation IAM permissions.
Enterprise security policies forbid long-lived static key downloads.
2
Select the specific predefined IAM role responsible for service account token creation.
Identify roles/iam.serviceAccountTokenCreator as the required role for generating OAuth2 access tokens and ID tokens via impersonation.
roles/iam.serviceAccountUser only allows attaching service accounts to resources, whereas roles/iam.serviceAccountTokenCreator allows minting short-lived tokens.
3
Apply the IAM role to the target principal on the target service account resource.
Bind [email protected] with roles/iam.serviceAccountTokenCreator on [email protected] following the principle of least privilege.
Resource-level binding limits token creation privileges strictly to the necessary service account.

Anahtar Kavram

Service Account Impersonation requires granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account to allow principals to generate short-lived credentials without JSON keys.
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru