Google Professional Cloud Security Engineer Question 38
Select 2Google Cloud PlatformYour organization uses Google Cloud to run a production environment that involves multiple microservices communicating with each other. Each microservice runs on Compute Engine instances and uses service accounts to access other Google Cloud resources. Recently, an audit revealed that one of the service accounts has permissions that exceed its intended scope, posing a security risk. How can you implement the principle of least privilege for service accounts in this environment?
- A
Audit the IAM policy bindings for all service accounts using the Google Cloud Console or gcloud CLI.
- B
Grant the Compute Engine default service account Project Editor role to all instances for simplicity.
- C
Use workload identity federation to map external identities to service accounts.
- D
Create custom IAM roles with only the necessary permissions and assign them to service accounts.
- E
Use the Service Account Token Creator role for all service accounts to improve security.
Show answer and explanation
Correct answers: A, D
Explanation
To implement the principle of least privilege in a Google Cloud environment, it is essential to audit the permissions of service accounts and assign only the permissions needed for a specific task. Auditing helps identify over-provisioned accounts, and using custom IAM roles ensures that permissions are narrowly scoped to the intended functionality, reducing the risk of unauthorized access or privilege escalation.
- A. Correct.
Auditing the IAM policy bindings for service accounts helps identify excessive or unnecessary permissions, which is a crucial step in implementing the principle of least privilege.
- B. Incorrect.
Granting the Project Editor role to the default Compute Engine service account violates the principle of least privilege, as it provides overly broad permissions.
- C. Incorrect.
Workload identity federation is used for mapping external identities to Google Cloud service accounts. While useful in some scenarios, it is not directly relevant to implementing least privilege for internal service accounts.
- D. Correct.
Creating custom IAM roles with only the necessary permissions ensures that service accounts have precisely the access they need, adhering to the principle of least privilege.
- E. Incorrect.
The Service Account Token Creator role allows a principal to impersonate a service account but does not inherently improve security or reduce permissions for service accounts.