Examkin

Soru

Zorluk: OrtaAdvising Development and Operation Teams

An enterprise development team is setting up an automated CI/CD pipeline using a deployment service account to provision Compute Engine instances via Terraform. The deployed virtual machines need to run applications under a dedicated runtime service account. The team wants to allow the pipeline service account to attach this runtime service account to the virtual machines without granting excess administrative permissions. Which recommendation should you give to the development team?

  1. Grant the deployment service account the Service Account User role on the dedicated runtime service account.Cevap
  2. B
    Grant the deployment service account the Service Account Admin role at the project level.
  3. C
    Grant the deployment service account the Project Editor primitive role.
  4. D
    Store the Terraform state files inside the temporary CI/CD runner local filesystem without persisting them to a Cloud Storage backend.

Cevap

Grant the deployment service account the Service Account User role on the dedicated runtime service account.
Granting the Service Account User role (roles/iam.serviceAccountUser) on the specific target service account allows the deployment pipeline to attach that service account to new Compute Engine instances. This fulfills the deployment requirement while adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify the required operational capability for the CI/CD deployment service account.
The pipeline needs permission to attach a specific runtime service account to Compute Engine instances.
Security best practices require restricting permission scope to only what is necessary for resource provisioning.
2
Evaluate Google Cloud IAM roles for service account attachment.
The Service Account User role (roles/iam.serviceAccountUser) permits an identity to attach a service account to a compute resource.
This role provides exact functional authorization without granting administrative capabilities over IAM resources.
3
Apply least privilege scoping.
Granting roles/iam.serviceAccountUser at the target service account resource level limits attachment rights strictly to that specific identity.
Resource-level IAM bindings prevent the deployment pipeline from attaching unauthorized service accounts.

Anahtar Kavram

Least privilege service account attachment and IAM scoping
Bu soruyu puanla

Konular

Advising Development and Operation Teams

Bu konudan daha fazla soru