Google Professional Cloud Security Engineer Question 71
Single answerGoogle Cloud PlatformYour team has a requirement to allow a CI/CD pipeline to access a Google Cloud Storage bucket for a deployment task. However, the credentials used should be short-lived to avoid long-term security risks. Which approach should you implement to meet this requirement?
- A
Create a service account key file and store it in the CI/CD pipeline for authentication.
- B
Use the Workload Identity Federation to exchange a short-lived token for Google Cloud access.
- C
Create a custom IAM role and assign it to the CI/CD pipeline to provide access to the bucket.
- D
Use the 'gcloud auth application-default login' command to generate temporary credentials for the CI/CD pipeline.
Show answer and explanation
Correct answer: B
Explanation
The best practice for managing short-lived credentials in scenarios like CI/CD pipelines is to use Workload Identity Federation. This eliminates the need for long-term service account keys by securely exchanging external credentials for temporary Google Cloud access, reducing the risk of credential compromise.
- A. Incorrect.
Storing a long-lived service account key file in the CI/CD pipeline introduces significant security risks. If the key is compromised, it could lead to unauthorized access. This does not meet the requirement for short-lived credentials.
- B. Correct.
Workload Identity Federation allows external identities, such as those in CI/CD systems, to impersonate a Google Cloud service account by exchanging short-lived credentials without using long-term service account keys. This approach aligns with the requirement for short-lived credentials.
- C. Incorrect.
Creating a custom IAM role does not address the need for short-lived credentials. While IAM roles define permissions, they do not control how credentials are managed.
- D. Incorrect.
The 'gcloud auth application-default login' command is intended for local development use and is not suitable for automated systems like CI/CD pipelines. Additionally, it does not provide a secure mechanism for generating short-lived credentials in this scenario.