A software company is designing an automated continuous delivery pipeline using Google Cloud Deploy to deploy stateless HTTP microservices to Cloud Run across staging and production environments. The security team mandates that the delivery pipeline service account must adhere to the principle of least privilege while allowing Cloud Deploy to act on behalf of the runtime service account during rollout execution. Which IAM role assignment configuration meets these security and pipeline automation requirements?
- Grant the Cloud Deploy execution service account the Cloud Run Developer role (roles/run.developer) and the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account.Cevap
- BGrant the Cloud Deploy execution service account the primitive Owner role (roles/owner) on the target Google Cloud project.
- CGrant the Cloud Deploy execution service account the Service Account Admin role (roles/iam.serviceAccountAdmin) on the target project.
- DProvision a multi-zone Google Kubernetes Engine (GKE) cluster for the release pipeline and assign the primitive Editor role to the execution service account.
Cevap
Grant the Cloud Deploy execution service account the Cloud Run Developer role (roles/run.developer) and the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account.
The correct approach enforces security best practices by granting the Cloud Deploy execution worker only the specific predefined permissions required for Cloud Run management (roles/run.developer) alongside the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime service account. This allows the delivery pipeline to deploy and attach the identity without exposing excessive administrative control.
Adım Adım Çözüm
Anahtar Kavram
Continuous Delivery Pipeline Identity & Least Privilege IAM Configuration