Google Associate Cloud Engineer Question 372
Select 3Google Cloud PlatformYou are tasked with setting up a secure environment on Google Cloud Platform where your application needs to access Google Cloud Storage for a short period. You decide to use short-lived service account credentials to enhance security. Which of the following steps should you take to implement this solution?
- A
Use the Google Cloud SDK to generate a new JSON key for the service account.
- B
Enable the Identity and Access Management (IAM) API.
- C
Use the OAuth 2.0 Token endpoint to generate access tokens for the service account.
- D
Create a new service account and assign it the necessary roles.
- E
Generate a signed URL for accessing Google Cloud Storage objects.
Show answer and explanation
Correct answers: B, C, D
Explanation
To implement short-lived service account credentials, you should enable the IAM API to manage service accounts, use the OAuth 2.0 Token endpoint to generate short-lived access tokens, and ensure the service account has the required roles for accessing Google Cloud Storage. Generating a new JSON key or using signed URLs does not align with the scenario's requirements for short-lived credentials.
- A. Incorrect.
Generating a new JSON key for a service account would create long-lived credentials, which contradicts the requirement for short-lived credentials.
- B. Correct.
Enabling the IAM API is necessary to manage service accounts and generate tokens programmatically.
- C. Correct.
Using the OAuth 2.0 Token endpoint allows you to generate short-lived access tokens for service accounts, suitable for temporary access.
- D. Correct.
Creating a service account and assigning it the necessary roles ensures that the service account has the permissions required to access Google Cloud Storage.
- E. Incorrect.
Generating a signed URL is a different approach for temporary access to Google Cloud Storage and does not involve service account credentials.