A cloud administrator needs to configure access for an external automated pipeline running on a self-hosted server so that it can read log files stored in a Cloud Storage bucket named `analytics-logs`. To comply with company security policies, the administrator must set up a dedicated user-managed service account using short-lived credentials via service account impersonation rather than using long-lived exported JSON keys.
Which of the following steps must the administrator take to implement this configuration securely? (Select TWO.)
- Create a user-managed service account within the project housing the Cloud Storage bucket.Cevap
- Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the service account to the external pipeline's authenticated identity.Cevap
- CGenerate a downloadable service account JSON key file and upload it to the external self-hosted server environment.
- DAssign the primitive Editor role (`roles/editor`) to the service account at the project level.
- EEnable Google Cloud APIs locally on the self-hosted server operating system using system environment flags.
Cevap
The administrator must create a user-managed service account in the GCP project hosting the storage bucket, and grant the Service Account Token Creator role on that service account to the external workload's identity.
To grant access via impersonation without static keys, an administrator creates a dedicated user-managed service account in the GCP project and grants the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on that service account to the calling identity. This allows the calling identity to mint short-lived security tokens dynamically.
Adım Adım Çözüm
Anahtar Kavram
Creating User-Managed Service Accounts & Service Account Impersonation
Tahmini Süre:1m 30s