An enterprise application hosted in an on-premises Kubernetes cluster needs to programmatically upload large batch analytical files to a Google Cloud Storage bucket without using static long-lived service account keys. The security team mandates that the architecture must adhere to the principle of least privilege and prevent credential exfiltration risks. Which of the following configuration steps should the team implement? (Select TWO.)
- Configure Workload Identity Federation to establish a trust relationship between the on-premises identity provider and Google Cloud IAM.Cevap
- Grant the federated identity permission to impersonate a dedicated service account bound strictly to the minimal Cloud Storage IAM roles required.Cevap
- CGenerate a service account JSON key file and mount it as a secret into the application pod, pointing GOOGLE_APPLICATION_CREDENTIALS to the key path.
- DAssign the primitive Owner IAM role to the service account to ensure all programmatic API calls execute without permission errors.
Cevap
The team should configure Workload Identity Federation between the on-premises identity provider and Google Cloud IAM, and grant the federated identity permission to impersonate a dedicated service account restricted to the necessary minimal Cloud Storage IAM roles.
Workload Identity Federation allows external applications to authenticate to GCP programmatically using short-lived tokens, eliminating long-lived key management risks. Granting permissions to impersonate a dedicated service account configured with fine-grained GCS access satisfies least-privilege requirements.
Adım Adım Çözüm
Anahtar Kavram
Keyless programmatic authentication using Workload Identity Federation and least-privilege Service Account Impersonation.