Examkin

Soru

Zorluk: ZorSecrets Management and Service Account Lifecycle Security

An enterprise application deployed on Compute Engine instances in Project A requires secure access to a PostgreSQL database password stored in Secret Manager in Project B. The secret is encrypted with a Customer-Managed Encryption Key (CMEK) managed in Cloud KMS within Project B. Corporate policy strictly forbids the generation of downloadable service account keys and requires adhering strictly to the principle of least privilege for cross-project access and secret decryption. Which configuration strategy should a Cloud Architect implement?

  1. Attach a custom service account to the Compute Engine instances in Project A. Grant this service account the Secret Manager Secret Accessor role on the target secret and the Cloud KMS CryptoKey Decrypter role on the specific CMEK key in Project B.Cevap
  2. B
    Attach a custom service account to the Compute Engine instances in Project A. Grant this service account the Editor primitive role at the Project B resource hierarchy level to ensure sufficient permissions for Secret Manager and Cloud KMS operations.
  3. C
    Reconfigure Secret Manager in Project B to use Customer-Supplied Encryption Keys (CSEK) instead of CMEK, and supply the raw encryption key directly within the application initialization parameters on Compute Engine.
  4. D
    Attach a custom service account to the Compute Engine instances in Project A, and assign it the Service Account Admin role in Project B so that it can impersonate the Secret Manager service account to access secrets.

Cevap

Attach a custom service account to the Compute Engine instances in Project A. Grant this service account the Secret Manager Secret Accessor role on the target secret and the Cloud KMS CryptoKey Decrypter role on the specific CMEK key in Project B.
Attaching a custom service account to the compute workload and granting the specific predefined roles (`roles/secretmanager.secretAccessor` and `roles/cloudkms.cryptoKeyDecrypter`) directly on the target secret and key resources satisfies cross-project security, avoids static credential management, and adheres strictly to least privilege.

Adım Adım Çözüm

1
Identify identity management best practices for Compute Engine
Avoid downloading JSON service account keys; use Application Default Credentials via an attached custom service account.
Eliminates static key leakage risks and complies with corporate security policy against downloading keys.
2
Configure cross-project IAM permissions for Secret Manager
Grant `roles/secretmanager.secretAccessor` on the specific secret resource in Project B to the Project A service account.
Allows reading secret payloads without granting project-level administrative access.
3
Configure CMEK decryption permissions in Cloud KMS
Grant `roles/cloudkms.cryptoKeyDecrypter` on the KMS key in Project B to the Project A service account.
Enables Secret Manager to decrypt the secret payload on behalf of the accessing identity using the CMEK key.

Anahtar Kavram

Cross-Project Least-Privilege IAM for Secret Manager and Cloud KMS CMEK Decryption
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru