Google Professional Cloud Developer Question 133
Select 3Google Cloud PlatformYou are developing a serverless application on Google Cloud that needs to access a Google Cloud Storage bucket. To follow the principle of least privilege and avoid managing service account keys, you decide to implement Workload Identity. Which steps are required to allow your application to access the bucket securely?
- A
Enable Workload Identity on the Google Kubernetes Engine (GKE) cluster or Cloud Run instance running your application.
- B
Bind the Google Cloud service account to a Kubernetes service account or Cloud Run service using Workload Identity.
- C
Grant the necessary IAM roles (e.g., Storage Object Viewer) on the bucket to the Kubernetes or Cloud Run service account.
- D
Configure your application to explicitly authenticate using the downloaded service account key file.
- E
Grant the necessary IAM roles (e.g., Storage Object Viewer) on the bucket to the Google Cloud service account.
Show answer and explanation
Correct answers: A, B, E
Explanation
Workload Identity allows workloads on GKE and Cloud Run to securely access Google Cloud resources without managing service account keys. The key steps include enabling Workload Identity, binding the Google Cloud service account to the workload-specific service account, and granting the necessary IAM roles to the Google Cloud service account. This ensures access follows the principle of least privilege while avoiding the risks associated with key management.
- A. Correct.
Correct. Enabling Workload Identity on the compute platform (GKE or Cloud Run) is the first step to securely bind a service account without using keys.
- B. Correct.
Correct. To use Workload Identity, the Google Cloud service account must be bound to a Kubernetes service account (in GKE) or a Cloud Run service.
- C. Incorrect.
Incorrect. IAM roles should be granted to the Google Cloud service account, not the Kubernetes or Cloud Run service account directly.
- D. Incorrect.
Incorrect. Using Workload Identity eliminates the need for managing service account keys, so this step is unnecessary.
- E. Correct.
Correct. The Google Cloud service account linked to the workload must have the required IAM roles on the bucket to access it.