Soru

Zorluk: OrtaSecrets Management and Service Account Lifecycle Security

An organization deploys a stateless microservice on Cloud Run in Project A. The application requires access to a database credential stored securely in Secret Manager within Project B. Corporate compliance policies mandate the strict elimination of long-lived service account key files and enforcement of least privilege access across project boundaries. Which architecture should you implement to satisfy these requirements?

  1. Attach a custom service account to the Cloud Run service in Project A, and grant that service account the Secret Manager Secret Accessor role specifically on the target secret in Project B.Cevap
  2. B
    Create a service account in Project B, download its JSON key file, store it as a secret in Project A, and grant the service account the Service Account Admin role in Project B.
  3. C
    Attach a custom service account to the Cloud Run service in Project A, and grant that service account the primitive Editor role at the Project B project level.
  4. D
    Configure Customer-Supplied Encryption Keys (CSEK) for Secret Manager in Project B, requiring the application container to manage and transmit raw encryption key material in API headers.

Cevap

Attach a custom service account to the Cloud Run service in Project A, and grant that service account the Secret Manager Secret Accessor role specifically on the target secret in Project B.
Attaching a custom service account to the Cloud Run service in Project A enables keyless authentication using Application Default Credentials. Granting that service account the Secret Manager Secret Accessor role directly on the secret resource in Project B ensures cross-project access is constrained strictly to the required payload, fulfilling both zero-key security guidelines and least privilege requirements.

Adım Adım Çözüm

1
Identify identity management best practices for Google Cloud compute workloads.
Using runtime service accounts eliminates the need for long-lived service account JSON key files.
Cloud Run allows attaching a custom service account directly to the service instance.
2
Determine the required IAM role and scope for Secret Manager across project boundaries.
Granting `roles/secretmanager.secretAccessor` directly on the specific secret resource in Project B grants minimum necessary permissions.
Resource-level IAM bindings adhere to the principle of least privilege without granting project-wide access.

Anahtar Kavram

Cross-Project Secret Access and Service Account IAM Governance
Bu soruyu puanla