Examkin

Soru

Zorluk: ZorSecrets Management and Service Account Lifecycle Security

An enterprise security architecture team needs to establish automated rotation for a database password stored in Google Cloud Secret Manager. The workflow must use Cloud Pub/Sub and a Cloud Function to automatically generate, test, and store new password versions every 90 days according to least privilege principles. In what order should the administrative steps be performed to configure this automated rotation pipeline?

  1. 1Grant the Secret Manager Service Agent (`service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com`) the Pub/Sub Publisher (`roles/pubsub.publisher`) role on the rotation topic.
  2. 2Deploy the rotation Cloud Function configured with a dedicated user-managed service account to handle key generation and database credential updates.
  3. 3Grant the rotator function's service account the Secret Manager Secret Version Adder (`roles/secretmanager.secretVersionAdder`) and Secret Accessor (`roles/secretmanager.secretAccessor`) roles on the target secret.
  4. 4Configure the rotation schedule duration and Pub/Sub rotation topic link on the target Secret Manager secret.

Cevap

The sequence of administrative steps must be: First, grant the Secret Manager Service Agent the Pub/Sub Publisher role on the notification topic. Second, deploy the rotator Cloud Function with a dedicated user-managed service account. Third, grant the rotator service account Secret Manager Secret Version Adder and Secret Accessor roles on the secret. Fourth, configure the rotation schedule and Pub/Sub topic on the target Secret Manager secret.
Configuring automated rotation in Secret Manager requires enabling infrastructure permissions prior to activating schedules. First, the Google-managed Secret Manager service agent requires `roles/pubsub.publisher` on the target Pub/Sub topic so rotation events can be emitted. Second, the rotation worker code (Cloud Function) and its dedicated service account must be deployed. Third, that dedicated service account must be granted least privilege permissions (`roles/secretmanager.secretVersionAdder` and `roles/secretmanager.secretAccessor`) on the secret resource. Finally, attaching the rotation schedule and Pub/Sub topic to the secret starts the timer and completes the pipeline.

Adım Adım Çözüm

1
Authorize Secret Manager Service Agent for Pub/Sub notification publishing
Secret Manager has permission to emit rotation topics.
Secret Manager uses a Google-managed service agent to send event notifications when rotation periods elapse.
2
Deploy the rotation Cloud Function with a custom service account identity
Rotator endpoint and identity are provisioned.
The function logic handles generating new database credentials and executing rotation tests.
3
Assign least privilege IAM roles to the rotator service account
Rotator function identity can add new secret versions without administrative privileges.
Applying specific Secret Manager roles ensures the function can fetch existing secrets and write newly rotated payload versions.
4
Attach rotation period and Pub/Sub topic parameters to Secret Manager secret metadata
Automated 90-day rotation trigger is active.
Configuring the secret schedule is the final step once target topics and execution workers are fully authorized.

Anahtar Kavram

Secret Manager Automated Rotation Architecture and IAM Authorization Lifecycle
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru