Google Associate Cloud Engineer Question 370
Select 2Google Cloud PlatformYou are a Google Cloud Engineer tasked with creating short-lived service account credentials for a deployment script that runs on a Compute Engine instance. Which of the following steps should you take to generate these credentials using the Google Cloud SDK?
- A
Use the 'gcloud auth activate-service-account' command with the key file.
- B
Use the 'gcloud iam service-accounts keys create' command to generate a new key.
- C
Set an environment variable GOOGLE_APPLICATION_CREDENTIALS with the path to the JSON key file.
- D
Use the 'gcloud auth application-default login' command to authenticate the script.
- E
Use the 'gcloud compute instances create' command with a service account email.
Show answer and explanation
Correct answers: B, C
Explanation
To manage short-lived service account credentials, you need to generate a new key for the service account using 'gcloud iam service-accounts keys create'. Once the key is downloaded, set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of the key file to ensure your application uses these credentials. These steps allow your script to authenticate using the temporary credentials provided by the service account key.
- A. Incorrect.
This command is used to activate a service account with an existing key, not to create short-lived credentials.
- B. Correct.
This command is correct for generating a new service account key, which can be used as short-lived credentials.
- C. Correct.
Setting the GOOGLE_APPLICATION_CREDENTIALS environment variable is necessary to ensure your script uses the short-lived credentials.
- D. Incorrect.
This command is used for user credentials, not for service account credentials.
- E. Incorrect.
This command creates a compute instance and assigns a service account, but it does not manage service account keys.