Your organization is configuring a third-party CI/CD pipeline hosted outside Google Cloud to deploy applications to a Google Cloud project. Company security policies strictly prohibit the creation and download of static, long-lived service account JSON key files. A target service account named [email protected] already exists with the necessary deployment permissions. Which approach should you implement to allow the external pipeline to authenticate and act as the service account while complying with Google security best practices?
- Configure Workload Identity Federation by creating a workload identity pool and provider, then grant the external repository principal identity the Workload Identity User role (roles/iam.workloadIdentityUser) on [email protected].Cevap
- BGenerate a new service account key using gcloud iam service-accounts keys create, base64-encode the key content, and store it within the CI/CD environment's encrypted secrets vault.
- CGrant the primitive Owner role (roles/owner) to the external identity provider directly at the target Google Cloud project resource hierarchy node.
- DGrant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the target service account at the organization level to allow external requests automatically through inheritance.
Cevap
Configure Workload Identity Federation by creating a workload identity pool and provider, then grant the external repository principal identity the Workload Identity User role (roles/iam.workloadIdentityUser) on [email protected].
Configuring Workload Identity Federation and binding the Workload Identity User role (roles/iam.workloadIdentityUser) to the external identity directly on the target service account allows short-lived token exchange for secure, keyless authentication.
Adım Adım Çözüm
Anahtar Kavram
Workload Identity Federation and Service Account Impersonation
Tahmini Süre:2m 0s