Examkin

Soru

Zorluk: OrtaSecrets Management and Service Account Lifecycle Security

An enterprise architecture team is integrating an on-premises application with Google Cloud services. The application requires access to database credentials stored in Secret Manager. To comply with corporate security governance, the solution must strictly eliminate the risk of long-lived service account key leaks, avoid primitive roles, and follow Google Cloud recommended least privilege standards. Which architecture meets these security requirements?

  1. Configure Workload Identity Federation with the on-premises OpenID Connect (OIDC) identity provider, grant the targeted service account the Secret Manager Secret Accessor role, and allow external workloads to exchange security tokens for short-lived credentials.Cevap
  2. B
    Create a service account, grant it the Editor primitive role at the project level, generate a JSON service account key, and deploy the key file to the on-premises server's encrypted file system.
  3. C
    Create a service account with the Service Account Admin role, export a long-lived service account key to the on-premises host, and rely on file system access control lists to prevent key unauthorized access.
  4. D
    Encrypt the secret payloads in Secret Manager using Customer-Supplied Encryption Keys (CSEK), and transmit the raw key from the on-premises host with every Secret Manager API invocation without using IAM service account authentication.

Cevap

Configure Workload Identity Federation with the on-premises identity provider and grant the service account the Secret Manager Secret Accessor role for short-lived credential access.
The correct approach uses Workload Identity Federation to establish trust between the on-premises OIDC/SAML identity provider and Google Cloud Cloud IAM. This allows the application to exchange external credentials for short-lived Google Cloud access tokens, removing the need to manage or store persistent service account JSON keys while enforcing least privilege through the Secret Manager Secret Accessor role.

Adım Adım Çözüm

1
Identify key requirements
The requirement demands accessing Secret Manager from on-premises without exporting long-lived service account keys.
Eliminating service account key management reduces security exposure from key leaks.
2
Select identity strategy
Federate external identities using Workload Identity Federation (OIDC/SAML).
Workload Identity Federation enables workloads running outside Google Cloud to impersonate service accounts using short-lived access tokens.
3
Apply least-privilege IAM roles
Assign `roles/secretmanager.secretAccessor` to the target service account.
This predefined role grants read access to secret payloads without administrative permissions or overly broad primitive access.

Anahtar Kavram

Workload Identity Federation and Least Privilege Secret Access
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru