Examkin

Soru

Zorluk: OrtaConfiguring Service Account Impersonation and Workload Identity

A security engineer needs to configure short-lived credential access for a developer working from a local terminal. The developer must deploy Cloud Storage resources by impersonating a dedicated service account named `[email protected]` without exporting service account JSON keys. Arrange the steps in the correct order to configure and enable service account impersonation using the gcloud CLI.

  1. 1Grant the required Cloud Storage Admin permissions to the target service account `[email protected]`.
  2. 2Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on `[email protected]` to the developer's Google Account.
  3. 3Authenticate the developer's local workstation CLI using `gcloud auth login` with their user account credentials.
  4. 4Configure the gcloud CLI to impersonate the target service account by running `gcloud config set auth/impersonate_service_account [email protected]`.

Cevap

The correct order begins with granting resource permissions to the target service account, followed by assigning the Service Account Token Creator role on the target service account to the developer, authenticating the user identity with `gcloud auth login`, and finally setting `gcloud config set auth/impersonate_service_account`.
To establish secure, keyless service account impersonation for local gcloud CLI execution, the workflow follows a precise logical sequence. First, the target service account must be granted the necessary workload permissions on target GCP resources. Second, the user identity must be granted the `Service Account Token Creator` role (`roles/iam.serviceAccountTokenCreator`) on the target service account to authorize short-lived token generation. Third, the user logs into gcloud using `gcloud auth login` to authenticate their user principal. Finally, running `gcloud config set auth/impersonate_service_account` configures the local gcloud environment to transparently request short-lived tokens for the specified target service account during resource operations.

Adım Adım Çözüm

1
Assign resource management roles to the target service account.
The service account `[email protected]` is granted the necessary Cloud Storage permissions.
Service account impersonation delegates authority, meaning the target service account itself must hold the permissions to perform actions.
2
Grant the developer the Service Account Token Creator role on the target service account resource.
The user identity is authorized to call the IAM credentials API to generate short-lived tokens for `[email protected]`.
Without `roles/iam.serviceAccountTokenCreator`, GCP IAM blocks attempts by the user principal to impersonate the service account.
3
Authenticate the developer's user identity in the local environment.
User credentials are established locally via `gcloud auth login`.
User authentication provides the underlying principal identity required to request impersonated tokens from GCP IAM.
4
Set the CLI authentication configuration to impersonate the target service account.
The gcloud CLI property `auth/impersonate_service_account` is configured.
This setting instructs gcloud to automatically mint and refresh short-lived tokens for the target service account for all gcloud operations.

Anahtar Kavram

Configuring Service Account Impersonation via gcloud CLI
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru