Google Associate Cloud Engineer Question 367
Select 2Google Cloud PlatformYour company uses Google Cloud Platform and has several services that need to interact securely. To achieve this, you decide to implement service account impersonation. Which of the following steps are necessary to configure service account impersonation correctly?
- A
Grant the 'Service Account Token Creator' role to the calling identity on the target service account.
- B
Enable the Cloud IAM API for the project.
- C
Assign the 'Service Account User' role to the service account that will be impersonated.
- D
Create a custom role with permissions for the target service account.
Show answer and explanation
Correct answers: A, B
Explanation
To configure service account impersonation, the calling identity must be granted the 'Service Account Token Creator' role on the target service account to allow token creation. Additionally, the Cloud IAM API must be enabled to manage IAM resources, including service account impersonation. Assigning the 'Service Account User' role or creating custom roles are not necessary steps specifically required for impersonation.
- A. Correct.
Correct. The 'Service Account Token Creator' role is required for the caller to generate access tokens for the target service account.
- B. Correct.
Correct. The Cloud IAM API must be enabled to manage and utilize service account impersonation.
- C. Incorrect.
Incorrect. The 'Service Account User' role is not required for impersonation; it is typically used to allow use of a service account.
- D. Incorrect.
Incorrect. Creating a custom role is not necessary for service account impersonation unless specific custom permissions are needed.