Examkin

Soru

Zorluk: KolayConfiguring Service Account Impersonation and Workload Identity

A Cloud Engineer needs to allow a developer to execute gcloud CLI commands by short-lived impersonation of a dedicated deployment service account, without creating or downloading service account keys. Which IAM role should be assigned to the developer on the target service account?

  1. Service Account Token Creator (roles/iam.serviceAccountTokenCreator)Cevap
  2. B
    Service Account Key Admin (roles/iam.serviceAccountKeyAdmin)
  3. C
    Editor (roles/editor)
  4. D
    Security Admin (roles/iam.securityAdmin)

Cevap

The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) should be assigned to the developer on the target service account.
The Service Account Token Creator role provides the exact permissions required to mint short-lived tokens and impersonate a Google Cloud service account without creating service account keys.

Adım Adım Çözüm

1
Identify the goal of keyless service account delegation.
The developer needs short-lived credential access via impersonation without generating persistent JSON private keys.
Impersonation eliminates key management overhead and security risks associated with long-lived key files.
2
Determine the predefined IAM role specific to token minting.
Select the Service Account Token Creator role.
This role includes the iam.serviceAccounts.getAccessToken permission needed to generate impersonation tokens for gcloud commands.

Anahtar Kavram

Service Account Impersonation Roles
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru