Examkin

Soru

Zorluk: OrtaSecrets Management and Service Account Lifecycle Security

A DevOps team needs to allow an application running on an external AWS EC2 instance to retrieve database credentials from GCP Secret Manager without creating or downloading service account keys. Sequence the steps required to establish Workload Identity Federation and securely access the secret following Google Cloud security best practices.

  1. 1Create a Workload Identity Pool and an AWS Workload Identity Provider in Google Cloud IAM to establish trust with the AWS account.
  2. 2Grant the external AWS IAM role permission to impersonate a dedicated GCP service account by assigning the Workload Identity User role (`roles/iam.workloadIdentityUser`) on the service account.
  3. 3Grant the dedicated GCP service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) on the required secret.
  4. 4Configure the application on the AWS EC2 instance to exchange its AWS credentials for a short-lived GCP access token using the Security Token Service (STS) API and fetch the secret.

Cevap

The correct order of steps is: 1) Create a Workload Identity Pool and AWS Provider in Google Cloud. 2) Grant the AWS IAM role permission to impersonate the GCP service account using the Workload Identity User role. 3) Grant the GCP service account the Secret Manager Secret Accessor role. 4) Exchange the AWS credentials for short-lived GCP tokens via the Security Token Service API to retrieve the secret.
Configuring Workload Identity Federation requires establishing trust with the external AWS provider first. Next, the external identity must be authorized to impersonate the designated GCP service account using the `roles/iam.workloadIdentityUser` role. Then, the GCP service account must be granted the specific secret access permission (`roles/secretmanager.secretAccessor`). Finally, the external application uses STS to exchange its native AWS security token for short-lived GCP credentials to fetch the secret payload.

Adım Adım Çözüm

1
Establish federation baseline
Workload Identity Pool and AWS Provider configured in GCP IAM
Google Cloud must recognize and validate assertion tokens issued by AWS IAM.
2
Bind external identity to GCP service account
IAM policy binding added for `roles/iam.workloadIdentityUser`
Allows authenticated AWS identities matching attribute conditions to impersonate the GCP service account.
3
Authorize secret access
GCP service account assigned `roles/secretmanager.secretAccessor`
Enforces least privilege by granting payload reading rights only to the service account, avoiding primitive roles.
4
Token exchange and runtime retrieval
Short-lived GCP access token generated and used to read secret
Eliminates static long-lived credentials by using short-lived tokens generated on demand via STS.

Anahtar Kavram

Workload Identity Federation for external workloads accessing GCP Secret Manager
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru