An enterprise operations team uses a centralized continuous integration runner authenticated as `[email protected]` in the project `shared-tools`. The runner needs to deploy infrastructure into project `prod-app-env` by assuming the identity of a target service account `[email protected]` without relying on exported credentials. Which TWO configuration steps are required to establish secure service account impersonation for this workflow? (Select TWO.)
- Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the target `[email protected]` service account resource.Cevap
- Enable the IAM Service Account Credentials API (`iamcredentials.googleapis.com`) in the project initiating the impersonation request.Cevap
- CGenerate a long-lived Service Account JSON private key for `[email protected]` and store it in the runner local filesystem.
- DAssign the Owner primitive role (`roles/owner`) to `[email protected]` at the organization level so permissions inherit down to all child resources.
Cevap
To enable service account impersonation, grant the initiating identity the Service Account Token Creator role on the target service account resource and enable the IAM Service Account Credentials API in the originating project.
Configuring service account impersonation requires granting the Service Account Token Creator role to the impersonating identity on the target service account resource. Additionally, the caller must make requests against the IAM Service Account Credentials API (`iamcredentials.googleapis.com`), which must be enabled in the originating project to issue short-lived tokens.
Adım Adım Çözüm
Anahtar Kavram
Service Account Impersonation requires granting the Service Account Token Creator role on the target service account and enabling the IAM Service Account Credentials API.