A central security auditing application hosted on a Compute Engine instance needs to programmatically scan metadata and security postures across multiple Google Cloud projects in an organization using the official Cloud Client Libraries. Security governance policies strictly prohibit the creation of exportable, long-lived service account key files and mandate minimal role privilege grants across all target projects. Which TWO configuration choices should you implement to establish secure programmatic authentication for the audit application?
- Configure the application to leverage Application Default Credentials (ADC) to automatically obtain short-lived tokens from the Compute Engine metadata server.Cevap
- Grant the instance service account the Service Account Token Creator role on target service accounts in each target project to enable short-lived impersonation.Cevap
- CGenerate service account JSON key files for each target project and dynamically load them into the auditing application via environment variables.
- DAssign the Owner primitive IAM role to the central auditing service account at the Organization level to ensure unhindered API access.
Cevap
The application should be configured to use Application Default Credentials (ADC) via the metadata server, paired with Service Account Impersonation using the Service Account Token Creator role on specific target service accounts.
Using Application Default Credentials allows the SDK to automatically query the Compute Engine metadata server for temporary credentials. Combining this with Service Account Impersonation using the Service Account Token Creator role enables short-lived, fine-grained access across target projects without creating exportable key files.
Adım Adım Çözüm
Anahtar Kavram
Programmatic GCP authentication via Application Default Credentials and Service Account Impersonation