Examkin

Soru

Zorluk: ZorCreating and Managing Service Accounts

An enterprise security policy mandates that an automated CI/CD pipeline executing on an external server must deploy Cloud Functions without using long-lived downloadable service account keys. The deployment script runs under an identity service account named [email protected]. A dedicated deployment service account named [email protected] has already been provisioned with the necessary Cloud Developer permissions. Which IAM configuration should the cloud engineer implement on func-deployer to allow cicd-runner to mint short-lived credential tokens under the principle of least privilege?

  1. Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to serviceAccount:[email protected] on the func-deployer service account resource.Cevap
  2. B
    Generate a new JSON service account key for [email protected] and encode it into the CI/CD pipeline secrets repository.
  3. C
    Grant the Owner primitive role (roles/owner) to serviceAccount:[email protected] at the project resource level.
  4. D
    Grant the Service Account User role (roles/iam.serviceAccountUser) to serviceAccount:[email protected] across the entire Google Cloud organization.

Cevap

Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to serviceAccount:[email protected] on the func-deployer service account resource.
To allow one identity to generate short-lived tokens on behalf of another service account securely, Google Cloud IAM requires granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the specific target service account resource to the calling principal identity. This satisfies least-privilege access and avoids creating static JSON service account keys.

Adım Adım Çözüm

1
Identify the target service account and the requesting identity service account.
The requesting principal is [email protected] and the target workload service account is [email protected].
Impersonation permissions must be granted on the target resource to the calling principal.
2
Select the appropriate IAM role for short-lived token generation.
The predefined IAM role roles/iam.serviceAccountTokenCreator permits generating OAuth2 access tokens, signed URLs, and JWTs.
This role provides the precise permissions needed for token minting without requiring static key files.
3
Apply the IAM binding scoped to the specific service account resource.
Bind roles/iam.serviceAccountTokenCreator specifically on the func-deployer service account resource for serviceAccount:[email protected].
Applying the role directly on the service account resource enforces the principle of least privilege, preventing access to other service accounts.

Anahtar Kavram

Service Account Impersonation and Short-Lived Credentials
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru