Examkin

Soru

Zorluk: KolayConfiguring Service Account Impersonation and Workload Identity

A security policy prohibits developers from creating or downloading private service account keys. An administrator needs to allow a developer's identity to temporarily generate short-lived credentials for a target service account to execute deployment tasks. Which IAM role should be granted to the developer's identity on the target service account?

  1. Service Account Token Creator (roles/iam.serviceAccountTokenCreator)Cevap
  2. B
    Service Account Key Admin (roles/iam.serviceAccountKeyAdmin)
  3. C
    Editor (roles/editor)
  4. D
    Security Admin (roles/iam.securityAdmin)

Cevap

Granting the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role on the target service account.
Granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account enables an authorized principal to generate short-lived OAuth2 tokens and impersonate the service account securely without creating or downloading private keys.

Adım Adım Çözüm

1
Identify the security requirement.
The requirement demands identity delegation via impersonation to mint short-lived tokens while avoiding long-lived private key creation.
Keyless authentication via service account impersonation aligns with GCP security best practices.
2
Select the appropriate fine-grained IAM role.
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) provides permission to create OAuth2 access tokens and sign payloads as the target service account.
Binding this role on the specific service account resource adheres strictly to the principle of least privilege.

Anahtar Kavram

Configuring Service Account Impersonation
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru