An organization deploys a stateless microservice on Cloud Run in Project A. The application requires access to a database credential stored securely in Secret Manager within Project B. Corporate compliance policies mandate the strict elimination of long-lived service account key files and enforcement of least privilege access across project boundaries. Which architecture should you implement to satisfy these requirements?
- Attach a custom service account to the Cloud Run service in Project A, and grant that service account the Secret Manager Secret Accessor role specifically on the target secret in Project B.Cevap
- BCreate a service account in Project B, download its JSON key file, store it as a secret in Project A, and grant the service account the Service Account Admin role in Project B.
- CAttach a custom service account to the Cloud Run service in Project A, and grant that service account the primitive Editor role at the Project B project level.
- DConfigure Customer-Supplied Encryption Keys (CSEK) for Secret Manager in Project B, requiring the application container to manage and transmit raw encryption key material in API headers.
Cevap
Attach a custom service account to the Cloud Run service in Project A, and grant that service account the Secret Manager Secret Accessor role specifically on the target secret in Project B.
Attaching a custom service account to the Cloud Run service in Project A enables keyless authentication using Application Default Credentials. Granting that service account the Secret Manager Secret Accessor role directly on the secret resource in Project B ensures cross-project access is constrained strictly to the required payload, fulfilling both zero-key security guidelines and least privilege requirements.
Adım Adım Çözüm
Anahtar Kavram
Cross-Project Secret Access and Service Account IAM Governance