Google Professional Cloud Security Engineer Question 74
Select 3Google Cloud PlatformYour organization is using an on-premises identity provider (IdP) to manage user authentication and has decided to grant external users access to Google Cloud resources without creating Google accounts. You need to configure Workload Identity Federation to allow the on-premises IdP to authenticate users and securely access Google Cloud resources. Which of the following steps are required to set up Workload Identity Federation correctly?
- A
Create a workload identity pool in Google Cloud and configure a provider for your on-premises IdP.
- B
Enable the 'Allow all users' setting in the workload identity pool to bypass additional authentication checks.
- C
Configure your on-premises IdP to issue secure tokens that comply with OIDC or SAML standards.
- D
Grant permissions to Google Cloud resources by binding IAM roles to the workload identity pool.
- E
Replace all service account keys with workload identity credentials for security reasons.
Show answer and explanation
Correct answers: A, C, D
Explanation
Workload Identity Federation allows external identities from on-premises or external IdPs to access Google Cloud without requiring Google accounts. To set this up, you must create a workload identity pool, configure it to accept tokens from your IdP, and bind IAM roles to the pool for resource access. Additionally, the IdP must issue secure, standards-compliant tokens. Enabling 'Allow all users' is insecure and not recommended, and while replacing service account keys improves security, it is not directly related to workload identity federation configuration.
- A. Correct.
Correct. Creating a workload identity pool and configuring a provider for the on-premises IdP is a required step to link the external IdP and Google Cloud.
- B. Incorrect.
Incorrect. The 'Allow all users' setting bypasses authentication and is not a secure practice. Google Cloud requires proper federated authentication mechanisms.
- C. Correct.
Correct. The on-premises IdP must issue secure tokens that comply with OIDC or SAML standards to ensure compatibility with Google Cloud's workload identity federation.
- D. Correct.
Correct. Permissions for Google Cloud resources must be granted by binding IAM roles to the workload identity pool or specific identities within the pool.
- E. Incorrect.
Incorrect. While replacing service account keys with workload identity credentials is a recommended best practice for enhanced security, it is not directly required for configuring workload identity federation.