Examkin

Soru

Zorluk: OrtaAdvising Development and Operation Teams

A cloud architect at an enterprise logistics company is advising a development team on establishing secure deployment practices. The team's automated CI/CD pipeline deploys application workloads onto Compute Engine virtual machines that execute under a dedicated runtime application service account. To enable the CI/CD pipeline identity to attach this runtime service account to newly created virtual machine instances during deployment, developers plan to assign the CI/CD service account the Service Account Admin role. Which recommendation should the architect provide to adhere to Google Cloud security best practices and the principle of least privilege?

  1. Grant the CI/CD pipeline service account the Service Account User role on the specific runtime application service account.Cevap
  2. B
    Grant the CI/CD pipeline service account the Service Account Admin role at the project level.
  3. C
    Grant the CI/CD pipeline service account the primitive Editor role across the project.
  4. D
    Migrate the application deployment target to a Google Kubernetes Engine (GKE) cluster to manage service account attachments automatically.

Cevap

Grant the CI/CD pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime application service account.
The correct recommendation is to grant the Service Account User role (roles/iam.serviceAccountUser) to the CI/CD pipeline service account on the specific runtime application service account. This allows the pipeline identity to pass the runtime service account to Compute Engine instances without granting administrative privileges to alter service accounts or project IAM policies.

Adım Adım Çözüm

1
Analyze the operational permission requirement
The deployment pipeline identity only needs permission to attach (impersonate/use) an existing runtime service account when provisioning compute resources.
Creating or modifying service accounts is not required during standard instance provisioning.
2
Evaluate IAM roles according to least privilege
The Service Account User role (roles/iam.serviceAccountUser) grants the exact permission (iam.serviceAccounts.actAs) necessary to attach the service account to compute instances.
Administrative roles such as Service Account Admin or primitive roles grant overprivileged access.
3
Formulate the architect's recommendation
Advise granting roles/iam.serviceAccountUser scoped specifically to the target runtime service account resource.
Resource-level scoping enforces minimal operational exposure while supporting deployment automation.

Anahtar Kavram

Applying Least Privilege with Service Account User Roles in Deployment Pipelines
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Advising Development and Operation Teams

Bu konudan daha fazla soru