An organization deploys a microservice on Cloud Run in Project A that needs to retrieve sensitive database credentials stored in Secret Manager in Project B. The security team mandates that identity management must strictly enforce the principle of least privilege, avoid long-lived credential exports, and minimize management overhead. Which architectural design should you implement to satisfy these security requirements?
- Create a dedicated custom service account in Project A, attach it to the Cloud Run service, and grant this service account the Secret Manager Secret Accessor role on the target secret in Project B.Cevap
- BCreate a service account in Project B, assign it the primitive Editor role at the project level, and export a JSON service account key to mount as an environment variable in Cloud Run.
- CGrant the Cloud Run service account the Service Account Admin role in Project B so that it can dynamically generate temporary service account keys at runtime to fetch the secret.
- DEncrypt the database credentials locally using Customer-Supplied Encryption Keys (CSEK) and embed the decryption key directly into the Cloud Run container image.
Cevap
Attach a dedicated custom service account in Project A to the Cloud Run service and grant it the Secret Manager Secret Accessor role directly on the specific secret residing in Project B.
Attaching a dedicated custom service account to the Cloud Run service in Project A and granting it the Secret Manager Secret Accessor role on the specific secret in Project B provides secure cross-project authorization. This approach leverages Google Application Default Credentials (ADC) to eliminate long-lived service account keys while strictly observing the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Cross-Project Secret Access with Least Privilege Service Accounts
Tahmini Süre:1m 30s