Google Associate Cloud Engineer Question 365
Select 2Google Cloud PlatformYou are managing a Google Cloud project and need to set up service account impersonation for a new application that requires access to resources across different projects. Which steps should you follow to correctly configure service account impersonation?
- A
Assign the 'Service Account Token Creator' role to the user who will impersonate the service account.
- B
Create a new service account with the necessary permissions and share the private key file with the application.
- C
Set up a policy binding that grants the 'roles/iam.serviceAccountUser' role on the target service account.
- D
Enable the 'Service Account Impersonation' API in the Google Cloud Console.
- E
Ensure the application uses the 'gcloud auth activate-service-account' command to authenticate as the service account.
Show answer and explanation
Correct answers: A, C
Explanation
Service account impersonation in Google Cloud involves granting the 'Service Account Token Creator' and 'iam.serviceAccountUser' roles. These roles allow a user or service account to generate tokens and act on behalf of the service account, enabling secure access to resources without sharing or managing private keys directly.
- A. Correct.
Assigning the 'Service Account Token Creator' role is necessary as it allows a user to generate access tokens for the service account.
- B. Incorrect.
Sharing a private key file is not a recommended practice and is insecure, hence not a correct approach for service account impersonation.
- C. Correct.
Setting up a policy binding with the 'roles/iam.serviceAccountUser' role allows a user or another service account to act as the service account, which is required for impersonation.
- D. Incorrect.
There is no API called 'Service Account Impersonation'; it is a feature managed through IAM roles and permissions.
- E. Incorrect.
The 'gcloud auth activate-service-account' command is used for activating a service account using a key file, not for impersonation.