A DevOps team is configuring an automated deployment runner in project `proj-ci-runner` that needs to deploy compute resources into target project `proj-prod-app`. Following Google Cloud security best practices, the team wants to avoid long-lived credentials while enforcing the principle of least privilege. Which two actions should the team perform to configure service account access correctly?
- Grant the service account in `proj-ci-runner` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the deployment service account in `proj-prod-app`.Cevap
- Grant the target deployment service account in `proj-prod-app` the specific predefined resource management roles required to deploy resources in `proj-prod-app`.Cevap
- CGenerate a long-lived service account JSON key for the deployment service account in `proj-prod-app` and store it in the build runner environment variables.
- DGrant the primitive Editor role (`roles/editor`) to the runner service account at the parent organization level to allow automated cross-project deployment access.
- EEnable the IAM Credentials API at the organization root folder level, assuming APIs do not need project-specific enablement.
Cevap
The correct configuration requires granting the runner service account in `proj-ci-runner` the Service Account Token Creator role on the deployment service account in `proj-prod-app`, and granting the target service account specific predefined roles in `proj-prod-app`.
To grant cross-project access securely without service account keys, the source service account must be granted the Service Account Token Creator role on the target service account in the target project. Furthermore, the target service account itself must be granted fine-grained predefined roles on the target project to perform deployment operations under the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Cross-Project Service Account Impersonation
Tahmini Süre:1m 30s