Examkin

Soru

Zorluk: ZorSecrets Management and Service Account Lifecycle Security

An organization is deploying an analytics microservice in Project A on Google Cloud Compute Engine that must query sensitive BigQuery datasets located in Project B. To comply with strict internal security policies, long-lived service account key export is explicitly forbidden, and privilege escalation risks must be minimized. The microservice needs to securely call BigQuery APIs under the identity of a designated workload service account created in Project B. Which configuration strategy fulfills these operational and security requirements while adhering to the principle of least privilege?

  1. Grant the service account attached to the Compute Engine instance in Project A the Service Account Token Creator role directly on the target workload service account in Project B, allowing it to generate short-lived OAuth2 access tokens via service account impersonation.Cevap
  2. B
    Grant the service account attached to the Compute Engine instance in Project A the Service Account Admin role across Project B so it can dynamically provision temporary service account keys on demand.
  3. C
    Assign the Editor primitive role at the Project B resource hierarchy level to the Compute Engine instance service account in Project A to enable cross-project API access.
  4. D
    Export a JSON service account key for the workload service account in Project B, encrypt the key file with Customer-Supplied Encryption Keys (CSEK), and store it on the Compute Engine boot disk.

Cevap

Grant the service account attached to the Compute Engine instance in Project A the Service Account Token Creator role directly on the target workload service account in Project B, allowing it to generate short-lived OAuth2 access tokens via service account impersonation.
The solution that grants the Service Account Token Creator role directly on the specific target service account enables keyless cross-project impersonation. It allows the microservice to obtain short-lived OAuth2 tokens securely while strictly honoring least privilege and avoiding service account key creation.

Adım Adım Çözüm

1
Identify key policy constraints
Long-lived service account key exports are prohibited, cross-project access is required, and minimal privilege must be enforced.
Security governance strictly demands short-lived token generation without static key management.
2
Evaluate GCP identity delegation mechanics
Service account impersonation allows an identity to mint short-lived tokens for another service account without holding key files.
IAM supports short-lived credential creation via the `roles/iam.serviceAccountTokenCreator` role.
3
Apply least privilege scoping
Bound the `roles/iam.serviceAccountTokenCreator` role directly to the target service account resource in Project B, rather than granting project-wide administrative or primitive roles.
Resource-level role binding ensures the calling service account can only impersonate the specific designated workload identity.

Anahtar Kavram

Cross-Project Service Account Impersonation and Token Creation
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru