Examkin

Soru

Zorluk: OrtaSecrets Management and Service Account Lifecycle Security

A retail platform processes customer transactions using microservices running on Compute Engine instances located in a Google Cloud project named `prod-compute`. The application needs to retrieve database credentials stored securely in Secret Manager located within a central security project named `prod-security`. As a Cloud Architect, you must configure authentication and authorization between the microservices and Secret Manager in accordance with Google-recommended security best practices and the principle of least privilege, while avoiding service account keys. Which strategy should you implement?

  1. Create a dedicated service account in `prod-compute`, attach it to the Compute Engine instances, and grant that service account the Secret Manager Secret Accessor role on the specific database secret in `prod-security`.Cevap
  2. B
    Generate a JSON service account key for a service account in `prod-security` with Secret Manager Secret Accessor permissions, and download the key file directly onto the Compute Engine instances.
  3. C
    Grant the Service Account Admin role to the default Compute Engine service account in `prod-compute` so it can manage service accounts and retrieve access tokens from `prod-security`.
  4. D
    Grant the Editor primitive role on the `prod-security` project to the Compute Engine default service account in `prod-compute`.

Cevap

Create a dedicated service account in the compute project, attach it to the Compute Engine instances, and grant that service account the Secret Manager Secret Accessor role on the specific database secret in the security project.
The Google-recommended practice for accessing Secret Manager secrets across projects is to attach a dedicated custom service account to the compute workload and grant that service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) specifically on the target secret resource in the security project. Compute Engine workloads leverage Application Default Credentials (ADC) to obtain short-lived access tokens automatically without managing service account JSON key files.

Adım Adım Çözüm

1
Define compute workload identity
Create a dedicated, custom service account in `prod-compute` specifically for the transaction processing microservices.
Attaching a dedicated custom service account avoids using default service accounts with overly broad permissions.
2
Configure cross-project resource permission
Grant `roles/secretmanager.secretAccessor` on the specific secret resource in `prod-security` to the custom service account.
Enforces least privilege at the individual secret level without granting project-wide read permissions.
3
Authenticate workloads keylessly
Allow Compute Engine workloads to automatically acquire credentials via Application Default Credentials (ADC) using the attached service account.
Eliminates the risk of managing static service account JSON keys and long-lived credential leakage.

Anahtar Kavram

Cross-Project Secret Access with Least Privilege and Application Default Credentials
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru