Examkin

Soru

Zorluk: ZorSecrets Management and Service Account Lifecycle Security

A financial enterprise is establishing a secure CI/CD pipeline using external GitHub Actions runners to deploy infrastructure and retrieve application configuration secrets stored in Google Cloud Secret Manager. The security team mandates a zero-trust model that completely eliminates downloadable long-lived service account keys, enforces strict credential scoping to specific Git repositories, and adheres to the principle of least privilege. Which TWO actions should you incorporate into the architecture to satisfy these security requirements?

  1. Configure Workload Identity Federation with attribute conditions mapped to the GitHub repository identity, allowing the pipeline to exchange OIDC tokens for short-lived Google Cloud credentials.Cevap
  2. B
    Generate a dedicated Service Account JSON key, upload it to GitHub Encrypted Secrets, and grant the pipeline identity the Service Account Admin role to manage credentials dynamically.
  3. Grant the Workload Identity Federation principal set the Workload Identity User role on the targeted deployment Service Account rather than assigning project-level primitive roles.Cevap
  4. D
    Assign the primitive Owner role to the Workload Identity Pool to allow seamless access across all Secret Manager resources and deployment APIs.
  5. E
    Configure Customer-Supplied Encryption Keys (CSEK) for all Secret Manager payloads to enforce local key ownership during credential retrieval by CI/CD runners.

Cevap

The correct architecture requires configuring Workload Identity Federation with attribute conditions for external OIDC token exchange, and granting the Workload Identity User role specifically on the target deployment service account.
Securing external non-GCP workloads without long-lived keys requires Workload Identity Federation. By configuring attribute conditions (e.g., assertion.repository == 'org/repo') and binding the Workload Identity User role directly on the deployment service account, external pipelines obtain short-lived access with strict repository scoping and minimal privileges.

Adım Adım Çözüm

1
Eliminate static service account keys using Workload Identity Federation.
External CI/CD workflows authenticate via short-lived OpenID Connect (OIDC) tokens mapped to a Workload Identity Pool.
Prevents secret exposure and management overhead associated with downloadable service account key files.
2
Restrict identity mapping with attribute conditions.
Only OIDC tokens issued to the exact repository and build environment are allowed to exchange tokens.
Prevents unauthorized repositories in the same organization from impersonating deployment credentials.
3
Apply fine-grained IAM impersonation permissions.
The external principal set receives the roles/iam.workloadIdentityUser binding strictly on the designated service account.
Adheres to the principle of least privilege by scope-limiting impersonation rights.

Anahtar Kavram

Workload Identity Federation and Service Account Lifecycle Security
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru