Google Professional Cloud Security Engineer Question 40
Select 2Google Cloud PlatformYour organization is using Google Cloud and has multiple applications running in separate projects. A new application in Project A needs to access a Cloud Storage bucket located in Project B. To ensure secure access, you decide to use service accounts. Which steps should you take to grant the appropriate permissions while adhering to the principle of least privilege?
- A
Create a service account in Project A and grant it the 'Storage Object Viewer' role on the bucket in Project B.
- B
Create a service account in Project B and grant it the 'Storage Admin' role on the bucket in Project B.
- C
Grant the 'Storage Object Viewer' role to the Project A service account at the project level in Project B.
- D
Use Workload Identity Federation to avoid using a service account key file, and assign the Project A service account access to the bucket in Project B.
- E
Generate a service account key for the Project A service account and share it with the developers working on the application.
Show answer and explanation
Correct answers: A, D
Explanation
To enable secure, least-privilege access for the application in Project A to the Cloud Storage bucket in Project B, you should create a service account in Project A and assign it the 'Storage Object Viewer' role directly on the bucket. Additionally, using Workload Identity Federation instead of service account keys enhances security by eliminating the risks associated with key management.
- A. Correct.
This is correct because creating a service account in Project A and granting it the 'Storage Object Viewer' role on the bucket in Project B follows the principle of least privilege and ensures secure cross-project access.
- B. Incorrect.
This is incorrect because granting the 'Storage Admin' role provides excessive permissions, violating the principle of least privilege.
- C. Incorrect.
This is incorrect because granting permissions at the project level is broader than necessary and does not align with the principle of least privilege.
- D. Correct.
This is correct because Workload Identity Federation is a secure practice that avoids the need to manage and distribute service account keys, reducing the risk of key compromise.
- E. Incorrect.
This is incorrect because sharing service account keys is an insecure practice and violates Google Cloud's recommendations for managing service accounts.