Examkin

Soru

Zorluk: ZorCreating and Managing Service Accounts

An organization is setting up a hybrid architecture where an on-premises application running inside a Linux server needs to upload hourly diagnostic reports directly to a Google Cloud Storage bucket in project `analytics-prod-994`. Security policy strictly forbids storing long-lived, downloadable service account key files (.json or .p12) on local disks outside of Google Cloud. Which of the following setup actions are required to establish secure, keyless access for this external workload using GCP recommended service account practices? (Select TWO.)

  1. Configure Workload Identity Federation by creating a Workload Identity Pool and Provider in Google Cloud IAM that trusts the on-premises identity provider.Cevap
  2. Grant the `roles/iam.workloadIdentityUser` role on the target service account to the external identity principal set defined in the Workload Identity Pool.Cevap
  3. C
    Generate a new service account key using `gcloud iam service-accounts keys create` and store it inside a restricted local directory on the Linux server.
  4. D
    Enable the Google Cloud Resource Manager API in the organization root folder to automatically trust all incoming HTTP requests originating from the on-premises public IP address range.
  5. E
    Assign the primitive `roles/owner` role directly to the service account at the project level so that it can dynamically bypass IAM token exchange checks.

Cevap

The required actions are establishing Workload Identity Federation by creating a Workload Identity Pool and Provider in GCP IAM, and granting the Workload Identity User role (`roles/iam.workloadIdentityUser`) on the service account to the federated external identity principal set.
To grant external workloads secure access to Google Cloud resources without exporting static service account keys, Google Cloud recommends Workload Identity Federation. This requires configuring a Workload Identity Pool and Provider to establish identity trust, and then granting `roles/iam.workloadIdentityUser` on the target service account to the external principal set so short-lived IAM credentials can be exchanged securely.

Adım Adım Çözüm

1
Set up external identity trust in Google Cloud IAM
Created Workload Identity Pool and Provider mapped to the on-premises identity provider.
Allows Google Cloud to authenticate incoming tokens issued by the external on-premises environment.
2
Bind the federated identity to the target GCP Service Account
Granted `roles/iam.workloadIdentityUser` to `principalSet://iam.googleapis.com/projects/.../attribute.my_attr/...` on the service account.
Authorizes the authenticated external workload identity to impersonate the GCP service account and obtain short-lived access tokens without static key files.

Anahtar Kavram

Keyless authentication for external workloads via Workload Identity Federation and Service Account Impersonation
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru