Google Professional Cloud Developer Question 135
Select 2Google Cloud PlatformYou are a developer tasked with deploying a containerized application on Google Kubernetes Engine (GKE). The application requires access to a Google Cloud Storage bucket for reading and writing files. For security compliance, you need to ensure that the application uses keyless authentication and adheres to the principle of least privilege. What steps should you take to achieve this?
- A
Enable Workload Identity on the GKE cluster and configure a Kubernetes service account to impersonate a Google Cloud service account with specific roles to access the bucket.
- B
Assign the 'Storage Admin' role to the default Compute Engine service account for the project to allow the application to access the bucket.
- C
Create a dedicated Google Cloud service account with the 'Storage Object Viewer' and 'Storage Object Creator' roles and configure Workload Identity to map it to a Kubernetes service account.
- D
Enable Workload Identity Federation and configure the application to use an external identity provider (e.g., AWS IAM) to access the Cloud Storage bucket.
- E
Manually generate and store service account keys in a Kubernetes Secret for the application to authenticate to Cloud Storage.
Show answer and explanation
Correct answers: A, C
Explanation
To achieve secure and keyless access while adhering to the principle of least privilege, you should use Workload Identity. This allows Kubernetes service accounts to impersonate Google Cloud service accounts without requiring service account keys. By assigning only the necessary roles ('Storage Object Viewer' and 'Storage Object Creator') to a dedicated service account, you ensure the application has just enough permissions to perform its tasks. Avoid practices like using default service accounts or manual key management, as they are insecure and do not follow best practices.
- A. Correct.
Correct. Enabling Workload Identity allows Kubernetes service accounts to impersonate Google Cloud service accounts securely without requiring long-lived credentials. Configuring the service account with specific roles ensures adherence to the principle of least privilege.
- B. Incorrect.
Incorrect. Assigning the 'Storage Admin' role to the default Compute Engine service account grants excessive permissions and violates the principle of least privilege. Additionally, using the default service account is not a recommended practice.
- C. Correct.
Correct. Creating a dedicated Google Cloud service account with specific roles like 'Storage Object Viewer' and 'Storage Object Creator' limits the permissions to only what the application requires. Mapping it to a Kubernetes service account via Workload Identity ensures secure and keyless authentication.
- D. Incorrect.
Incorrect. While Workload Identity Federation is a valid approach for external identity providers, it is unnecessary in this scenario since the application is running on GKE and can use Workload Identity directly.
- E. Incorrect.
Incorrect. Manually generating and storing service account keys introduces security risks as keys can be exposed or mishandled. Keyless authentication methods like Workload Identity are the preferred approach.