A DevOps team needs to allow a cloud administrator ([email protected]) to execute infrastructure provisioning scripts against a target Google Cloud project from their local machine. Enterprise security policies strictly prohibit downloading or storing long-lived service account keys locally. The administrator must impersonate a dedicated deployment service account ([email protected]) using short-lived credentials. Which TWO actions must be completed to grant and use service account impersonation for this workflow?
- Grant [email protected] the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account.Cevap
- BCreate and download a JSON service account key for [email protected] and set the GOOGLE_APPLICATION_CREDENTIALS environment variable locally.
- Configure the local gcloud CLI to use the --impersonate-service-account flag or set the auth/impersonate_service_account property.Cevap
- DGrant [email protected] the primitive Owner role (roles/owner) at the parent folder level to grant implicit token creation rights.
Cevap
The two required actions are granting the administrator identity the Service Account Token Creator role on the target service account, and configuring the local gcloud CLI to use the --impersonate-service-account flag or setting the auth/impersonate_service_account property.
To configure keyless short-lived service account impersonation from a local terminal, the principal must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource. Additionally, the local gcloud CLI must be configured to request short-lived tokens by supplying the --impersonate-service-account flag or setting the auth/impersonate_service_account configuration property.
Adım Adım Çözüm
Anahtar Kavram
Configuring Service Account Impersonation with gcloud CLI