A security engineer needs to configure a dedicated user-managed service account for an application that publishes telemetry data to Google Cloud Pub/Sub. To satisfy security policies prohibiting long-lived JSON keys, the developer group (`[email protected]`) must be granted access to test the application by impersonating the service account. Place the operational steps in the correct sequence to complete this configuration.
- 1Create a custom user-managed service account named `telemetry-pub-sa` in the target project.
- 2Grant the `roles/pubsub.publisher` IAM role to `telemetry-pub-sa` on the Pub/Sub topic.
- 3Bind the `roles/iam.serviceAccountTokenCreator` role to `group:[email protected]` on the `telemetry-pub-sa` service account resource.
- 4Execute `gcloud` testing commands specifying `--impersonate-service-account=telemetry-pub-sa@<project-id>.iam.gserviceaccount.com`.
Cevap
The correct sequence starts with creating the service account identity, assigning the Pub/Sub Publisher role to the service account, granting the Service Account Token Creator role to the developer group on the service account resource, and finally running test commands using the impersonation flag.
The logical and operational dependency order requires establishing the service account identity first. Second, functional workload access (`roles/pubsub.publisher`) is granted to the service account so it can interact with Pub/Sub. Third, security governance is enforced by granting the developer group the `roles/iam.serviceAccountTokenCreator` role specifically on the service account resource, enabling keyless short-lived credential generation. Fourth, developers can invoke commands using `--impersonate-service-account` to execute actions as the service account.
Adım Adım Çözüm
Anahtar Kavram
Creating User-Managed Service Accounts and Configuring Impersonation via Service Account Token Creator
Tahmini Süre:1m 30s