Examkin

Soru

Zorluk: Çok zorCreating and Managing Service Accounts

Your organization operates an on-premises automated data processing platform that needs to read and write data objects in Google Cloud Storage buckets located in a target project named `proj-analytics-prod`. Security mandates require that no long-lived service account JSON keys are generated or stored on external systems, access must strictly adhere to the principle of least privilege, and identity management must be centralized in a dedicated project named `proj-iam-central`.

Which TWO configuration steps must you execute to grant the external workload access to Cloud Storage? (Select TWO.)

  1. Configure Workload Identity Federation in `proj-iam-central` to map the external workload's identity to a service account created in `proj-iam-central`, allowing short-lived token exchange without key downloads.Cevap
  2. Grant the `roles/storage.objectAdmin` predefined role to the centralized service account on the specific Cloud Storage buckets in `proj-analytics-prod`.Cevap
  3. C
    Generate a service account JSON key file in `proj-iam-central` and upload it to the on-premises platform's credential store.
  4. D
    Grant the primitive `roles/editor` role to the centralized service account at the project level of `proj-analytics-prod`.
  5. E
    Grant the `roles/iam.serviceAccountUser` role to the external workload identity on `proj-analytics-prod` so that project-level storage permissions are inherited automatically.

Cevap

The correct implementation requires configuring Workload Identity Federation in the central project to enable short-lived keyless authentication, and granting the Storage Object Admin predefined role to the central service account on the target Cloud Storage buckets in the destination project.
To fulfill the requirements, Workload Identity Federation must be configured in the central identity project to provide keyless authentication for the external workload via short-lived tokens. Furthermore, to satisfy least privilege and enable cross-project access, the central service account must be granted the predefined Storage Object Admin role specifically on the Cloud Storage buckets within the target project.

Adım Adım Çözüm

1
Establish keyless authentication mechanism for external workloads.
Workload Identity Federation is configured in `proj-iam-central`, enabling the external system to exchange identity tokens for short-lived GCP service account access tokens.
This eliminates the compliance risk associated with exportable, long-lived JSON keys.
2
Configure cross-project permissions adhering to least privilege.
The central service account is granted `roles/storage.objectAdmin` on the target storage buckets inside `proj-analytics-prod`.
Granting predefined object-level roles at the resource scope ensures the service account can only perform necessary storage operations without broad project-wide administrative rights.

Anahtar Kavram

Keyless cross-project authentication using Workload Identity Federation and least-privilege predefined IAM roles.
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru