Examkin

Soru

Zorluk: ZorCreating and Managing Service Accounts

A security administrator needs to grant a development team the ability to deploy Cloud Run services that execute under an existing user-managed service account named [email protected]. Security policy strictly requires enforcing the principle of least privilege and forbids developers from creating service account keys or modifying IAM policies on the service account. Which IAM configuration fulfills these requirements?

  1. A
    Grant the developers the Service Account Key Admin role (roles/iam.serviceAccountKeyAdmin) on the specific service account resource.
  2. B
    Grant the developers the Editor primitive role (roles/editor) at the project level.
  3. Grant the developers the Service Account User role (roles/iam.serviceAccountUser) on the specific service account resource.Cevap
  4. D
    Grant the developers the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level.

Cevap

Granting the Service Account User role (roles/iam.serviceAccountUser) resource-level access on the specific service account gives developers the exact permission required to bind the service account to compute resources like Cloud Run, while withholding service account management and key creation rights.
To allow a identity to attach a service account to a compute service (such as Cloud Run or Compute Engine), the identity requires the Service Account User role (roles/iam.serviceAccountUser). Binding this role directly on the specific service account resource restricts authorization to that single identity, satisfying the principle of least privilege without providing key generation or IAM administrative permissions.

Adım Adım Çözüm

1
Identify the functional requirement
Developers need permission to attach an existing service account to a compute resource (Cloud Run).
Deploying resources that run as a managed identity requires service account usage authorization.
2
Determine the least-privilege IAM role for attaching service accounts
The predefined role roles/iam.serviceAccountUser provides the iam.serviceAccounts.actAs permission.
This permission allows a principal to impersonate or run operations under the service account without exposing credentials.
3
Apply resource-level IAM scoping
Bind roles/iam.serviceAccountUser directly to [email protected] rather than project-wide.
Restricting the IAM binding to the specific service account resource prevents unauthorized usage of other service accounts in the project.

Anahtar Kavram

Delegating Service Account Usage with Least Privilege
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru