Google Associate Cloud Engineer Question 373
Single answerGoogle Cloud PlatformYou are working as a Cloud Engineer for a company that uses Google Cloud Platform. Your team needs to create short-lived service account credentials for an application that runs on Compute Engine instances. These credentials should be automatically rotated and managed by Google Cloud. Which of the following options would you use to achieve this?
- A
Use Google Cloud Console to manually generate a new service account key every hour.
- B
Leverage Workload Identity Federation to grant external identities access to Google Cloud resources.
- C
Use Service Account Key Management to auto-rotate keys every 90 days.
- D
Utilize the Compute Engine's built-in service account with access scopes.
Show answer and explanation
Correct answer: D
Explanation
The Compute Engine's built-in service account is designed to automatically manage short-lived credentials, providing seamless and secure access to Google Cloud resources from Compute Engine instances. This eliminates the need for manual key management and ensures that credentials are automatically rotated by Google Cloud, aligning perfectly with the requirement for short-lived credentials.
- A. Incorrect.
Manually generating service account keys every hour is not practical and does not automate the process.
- B. Incorrect.
Workload Identity Federation is used for granting access to external identities, not for managing short-lived credentials.
- C. Incorrect.
Service Account Key Management with a 90-day rotation is not considered short-lived for highly dynamic environments.
- D. Correct.
Compute Engine's built-in service account automatically handles short-lived credentials and rotates them, making it suitable for this scenario.