A software development team migrated a legacy application to Google Cloud and granted primitive Owner roles to several application service accounts to accelerate initial deployment. An architectural review identified this setup as a critical security technical debt risk. Which action should the cloud architect recommend to mitigate this technical debt?
- Audit the exact permissions used by the application and replace the primitive roles on the service accounts with specific predefined or fine-grained custom IAM roles.Cevap
- BGrant the Service Account Admin role to all application service accounts so they can automatically manage their own identity lifecycle and permissions.
- CMigrate the application workloads to a Google Kubernetes Engine (GKE) cluster to handle permission isolation at the container orchestration layer.
- DMaintain the current IAM permissions locally in unversioned Terraform state files to restrict unauthorized access to the security configuration.
Cevap
Audit the exact permissions used by the application and replace the primitive roles on the service accounts with specific predefined or fine-grained custom IAM roles.
Replacing primitive roles with fine-grained predefined or custom roles directly remediates security technical debt by removing unneeded high-privilege access while ensuring the application maintains necessary operations.
Adım Adım Çözüm
Anahtar Kavram
Assessing and Mitigating IAM Technical Debt via Least Privilege
Tahmini Süre:1m 0s