Examkin

Soru

Zorluk: OrtaConfiguring Service Account Impersonation and Workload Identity

An organization uses an automated security auditing script running on a centralized admin virtual machine. The script needs temporary credentials to inspect configuration settings across multiple Google Cloud projects by impersonating a target service account named `[email protected]`. The security policy strictly prohibits creating or downloading long-lived service account key files. Which IAM configuration should the cloud engineer apply to enable this setup while adhering to the principle of least privilege?

  1. Grant the admin VM's identity the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the auditor service account.Cevap
  2. B
    Generate a JSON service account key for auditor-sa and store it securely in Secret Manager for the script to download during execution.
  3. C
    Grant the admin VM's identity the Service Account User role (roles/iam.serviceAccountUser) on the target service account.
  4. D
    Grant the admin VM's identity the Project Editor primitive role (roles/editor) on the project containing the auditor service account.

Cevap

Grant the admin VM's identity the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the auditor service account.
To impersonate a service account and generate short-lived credentials (like access tokens or ID tokens), a principal must have the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) granted on the target service account. This allows keyless authentication while adhering to least privilege.

Adım Adım Çözüm

1
Identify the authentication requirement
The automated auditing script requires short-lived credential generation for service account impersonation without downloading long-lived JSON keys.
Security policy forbids static service account keys.
2
Evaluate required IAM permissions for impersonation
The Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) grants `iam.serviceAccounts.getAccessToken` and related permissions needed to generate short-lived tokens.
This enables secure, direct impersonation of the target service account.
3
Apply least privilege scoping
Bind `roles/iam.serviceAccountTokenCreator` directly on the target service account resource rather than assigning broad project-level roles.
Ensures the admin principal can only impersonate the specific designated auditing identity.

Anahtar Kavram

Service Account Impersonation and Short-Lived Credentials
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru