Examkin

Soru

Zorluk: OrtaSecrets Management and Service Account Lifecycle Security

A financial technology company operates an on-premises data processing engine that must securely ingest daily batch files into a Google Cloud Storage bucket in Project A. To enable access, a developer generated a service account JSON key file and deployed it directly to the on-premises servers. The lead security architect mandates that long-lived credentials must be completely eliminated while ensuring the on-premises application adheres strictly to the principle of least privilege. Which architectural solution should be implemented?

  1. Set up Workload Identity Federation between the on-premises identity provider and Google Cloud, allowing the application to exchange short-lived tokens to impersonate a service account granted the Storage Object Creator role.Cevap
  2. B
    Grant the Service Account Admin role to the service account, and write a custom automation script on the on-premises server to continuously request newly generated service account JSON keys every 24 hours.
  3. C
    Assign the primitive Editor role to the project service account and store the exported JSON key file inside a Customer-Supplied Encryption Key (CSEK) encrypted Cloud Storage bucket for local retrieval.
  4. D
    Configure Customer-Supplied Encryption Keys (CSEK) to encrypt the batch files during transit while maintaining the existing static service account JSON key protected inside a VPC Service Controls perimeter.

Cevap

Configure Workload Identity Federation with an on-premises identity provider to exchange short-lived tokens for service account impersonation using the Storage Object Creator role.
Workload Identity Federation enables external on-premises workloads to authenticate to Google Cloud APIs by exchanging external credentials for short-lived OAuth 2.0 access tokens. Granting the Storage Object Creator role satisfies the principle of least privilege by allowing file upload capabilities without full bucket management access.

Adım Adım Çözüm

1
Identify authentication mechanism requirement
Recognize that static downloadable service account keys must be replaced with keyless short-lived credential federation.
Security best practices recommend eliminating long-lived service account keys for external workloads.
2
Configure identity federation
Establish Workload Identity Federation between the on-premises identity provider (OIDC/SAML) and Google Cloud.
This allows the external server to authenticate without downloading key files.
3
Apply least privilege IAM permissions
Bind the federated identity to a Google Cloud service account with only the Storage Object Creator role.
The workload only requires permission to write daily batch files to Cloud Storage.

Anahtar Kavram

Workload Identity Federation for keyless authentication and service account least privilege
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru