Google Professional Cloud Security Engineer Question 67
Single answerGoogle Cloud PlatformYour organization uses Google Cloud and has implemented strict security policies requiring the use of short-lived credentials to access Cloud Storage buckets. A developer needs to programmatically upload files to a bucket but should not have long-term access to the storage resources. Which of the following approaches ensures compliance with the security policy?
- A
Use a service account key file and share it with the developer for authentication.
- B
Generate a signed URL for the developer to upload files directly to the Cloud Storage bucket within a specified time frame.
- C
Assign the developer the 'Storage Admin' IAM role directly on the bucket.
- D
Configure a workload identity pool to allow the developer to federate an external identity and generate short-lived tokens for access.
Show answer and explanation
Correct answer: B
Explanation
The correct answer is to generate a signed URL because it ensures that the developer can upload files to the Cloud Storage bucket while adhering to the organization's requirement for short-lived credentials. Signed URLs provide time-limited access and do not expose long-term credentials, making them an effective and secure solution for this use case.
- A. Incorrect.
Using a service account key file introduces security risks as the credentials are long-lived and can be exposed if mishandled. This does not comply with the policy for short-lived credentials.
- B. Correct.
Generating a signed URL is the correct approach, as it creates a time-limited credential that allows the developer to upload files directly without granting long-term access to the bucket.
- C. Incorrect.
Assigning the 'Storage Admin' IAM role directly on the bucket provides long-term access to the developer, which violates the policy requiring short-lived credentials.
- D. Incorrect.
While workload identity pools are useful for federating external identities, this approach is not the most direct or suitable solution for programmatically uploading files in this specific scenario.