A DevOps engineer needs to grant an external automation pipeline short-lived authorization to upload build artifacts to a Google Cloud Storage bucket in project `proj-prod` without using long-lived service account key files. The engineer decides to implement service account impersonation. What is the correct sequence of steps to configure and execute this secure delegation workflow?
- 1Create a dedicated user-managed service account named `[email protected]` in project `proj-prod`.
- 2Grant the `roles/storage.objectAdmin` role to `[email protected]` on the target Cloud Storage bucket.
- 3Grant the `roles/iam.serviceAccountTokenCreator` role on `[email protected]` to the calling pipeline principal identity.
- 4Execute the artifact upload command using `gcloud storage` with the `--impersonate-service-account=artifact-pipeline-sa@proj-prod.iam.gserviceaccount.com` flag.
Cevap
The correct order begins with creating the dedicated service account, followed by granting object administration permissions to the service account on the Cloud Storage bucket, then delegating the Service Account Token Creator role on the service account to the calling principal, and finally running the gcloud command with the --impersonate-service-account flag.
The workflow follows logical identity management dependency. First, the service account identity must be created in the project (`[email protected]`). Second, resource permissions (`roles/storage.objectAdmin`) are granted to the service account so it possesses the necessary permissions. Third, impersonation privileges (`roles/iam.serviceAccountTokenCreator`) are granted on the service account resource to the external caller identity. Finally, the external caller executes the gcloud CLI command with `--impersonate-service-account` to generate short-lived tokens dynamically.
Adım Adım Çözüm
Anahtar Kavram
Service Account Creation, Permission Delegation, and Impersonation Sequence