Examkin

Soru

Zorluk: ZorSecrets Management and Service Account Lifecycle Security

An organization is migrating an on-premises deployment pipeline to interact with Google Cloud resources. The pipeline needs to fetch database credentials stored in Google Cloud Secret Manager to deploy application updates. Organization security governance strictly forbids the creation of exportable long-lived service account keys and mandates strict adherence to the principle of least privilege. Which solution should the cloud architect implement to meet these requirements securely?

  1. Configure Workload Identity Federation using the on-premises environment's OpenID Connect (OIDC) identity provider, allowing the pipeline to exchange short-lived tokens and impersonate a GCP service account granted the Secret Manager Secret Accessor role on the specific secret.Cevap
  2. B
    Create a service account key JSON file, upload it securely to the on-premises deployment server, and grant the service account the Service Account Admin role so it can dynamically generate short-lived tokens during build execution.
  3. C
    Generate a static service account key, store it in an environment variable on the build runner, and assign the primitive Editor role to the service account to ensure full operational access across Secret Manager and compute resources.
  4. D
    Encrypt the secret payloads using Customer-Supplied Encryption Keys (CSEK), store the raw AES-256 key in the on-premises pipeline script, and grant the service account standard IAM access to Secret Manager.

Cevap

Configure Workload Identity Federation with an external OIDC provider to allow short-lived service account token exchange, and grant the service account the Secret Manager Secret Accessor role on the specific secret.
Workload Identity Federation allows external workloads running outside Google Cloud to authenticate securely using short-lived tokens from an external OIDC provider, satisfying the requirement to eliminate long-lived service account keys. Coupling identity federation with the fine-grained Secret Manager Secret Accessor role bound to a specific secret enforces least-privilege access controls.

Adım Adım Çözüm

1
Eliminate static service account keys
Avoid exportable long-lived JSON keys by establishing Workload Identity Federation with the external on-premises OIDC identity provider.
Security governance strictly prohibits long-lived service account key files due to risks of credential exposure and compliance violations.
2
Configure identity federation and impersonation
Map external OIDC identity claims to a target GCP service account using workload identity pools and providers.
Allows on-premises workloads to exchange native short-lived identity tokens for short-lived Google Cloud federated access tokens.
3
Apply least privilege IAM permissions
Grant the targeted service account the `roles/secretmanager.secretAccessor` role specifically scoped to the required secret resource.
Ensures the deployment pipeline can read secret values without receiving excessive project-level or administrative permissions.

Anahtar Kavram

Workload Identity Federation & Service Account Lifecycle Governance
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru