Examkin

Soru

Zorluk: OrtaConfiguring Service Account Impersonation and Workload Identity

A database administrator needs to execute local gcloud CLI commands to update Cloud Spanner schema configurations using the dedicated service account [email protected]. Security policy strictly forbids creating or downloading static service account JSON keys. Which IAM role assignment and gcloud configuration allows the administrator to temporarily assume the identity of the service account?

  1. Grant the administrator the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account, and pass the --impersonate-service-account flag in gcloud commands.Cevap
  2. B
    Generate a short-lived service account key file using gcloud iam service-accounts keys create, configure gcloud auth activate-service-account, and delete the key file after execution.
  3. C
    Grant the administrator the primitive Owner role (roles/owner) on the project containing the service account so that all CLI calls automatically run with service account authorization.
  4. D
    Grant the administrator the Service Account User role (roles/iam.serviceAccountUser) on the project, and explicitly deny token creation permissions on the individual service account.

Cevap

Grant the administrator the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account, and pass the --impersonate-service-account flag in gcloud commands.
To impersonate a service account using Google Cloud CLI without static service account keys, the user principal performing the action must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account. When the user executes gcloud commands with the --impersonate-service-account flag, gcloud requests short-lived credentials for that service account.

Adım Adım Çözüm

1
Identify the security constraint and goal.
The requirement is keyless delegation where a user principal impersonates a target service account via gcloud CLI.
Security directives prohibit static JSON service account key creation.
2
Determine the mandatory IAM role for generating impersonation tokens.
The target identity requires roles/iam.serviceAccountTokenCreator to be granted to the calling user principal.
This permission allows minting short-lived OAuth access tokens on behalf of the target service account.
3
Select the correct gcloud CLI execution mechanism.
Append --impersonate-service-account=spanner-admin@prod-project.iam.gserviceaccount.com to gcloud commands or set gcloud config set auth/impersonate_service_account.
This directs gcloud to fetch short-lived credentials for the target service account using the user's authenticated identity.

Anahtar Kavram

Service Account Impersonation via gcloud and IAM Token Creator Role
Bu soruyu puanla

Konular

Configuring Service Account Impersonation and Workload Identity

Bu konudan daha fazla soru