Examkin

Soru

Zorluk: OrtaCreating and Managing Service Accounts

A security mandate for a Google Cloud project named `analytics-prod` prohibits developers from generating or downloading long-lived JSON service account keys. A cloud engineer using the identity `[email protected]` needs temporary authorization to mint short-lived OAuth 2.0 access tokens for an existing service account named `[email protected]`. Which command should an administrator run to grant the engineer the necessary permission directly on the service account using the principle of least privilege?

  1. gcloud iam service-accounts add-iam-policy-binding [email protected] --member="user:[email protected]" --role="roles/iam.serviceAccountTokenCreator"Cevap
  2. B
    gcloud iam service-accounts keys create key.json --iam-account=data-pipeline@analytics-prod.iam.gserviceaccount.com
  3. C
    gcloud projects add-iam-policy-binding analytics-prod --member="user:[email protected]" --role="roles/editor"
  4. D
    gcloud projects add-iam-policy-binding analytics-prod --member="user:[email protected]" --role="roles/iam.serviceAccountUser"

Cevap

Execute the `gcloud iam service-accounts add-iam-policy-binding` command targeting the specific service account and assigning the `roles/iam.serviceAccountTokenCreator` role to the user.
To allow a developer to generate short-lived access tokens for a service account without key creation, the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) should be bound directly to the target service account resource using `gcloud iam service-accounts add-iam-policy-binding`.

Adım Adım Çözüm

1
Identify the security requirement and identity mechanism.
The scenario requires short-lived credential generation without creating static JSON keys.
Security best practices discourage long-lived service account key downloads in favor of IAM impersonation and token generation.
2
Select the appropriate IAM role for token creation.
The `roles/iam.serviceAccountTokenCreator` role allows generating short-lived access tokens.
This specific predefined role grants permissions to sign tokens and impersonate the target service account.
3
Determine the binding target resource.
Bind the policy directly to `[email protected]`.
Applying the role binding to the specific service account resource enforces the principle of least privilege instead of project-wide access.

Anahtar Kavram

Managing Service Account Impersonation and Token Creation via IAM Policy Bindings
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru