Google Professional Cloud Security Engineer Question 76
Select 3Google Cloud PlatformYour organization uses an external identity provider (IdP) for managing user authentication. To avoid using long-lived Google Cloud service account keys, you decide to configure Workload Identity Federation to allow your workloads to securely access Google Cloud resources. Which steps are necessary to successfully configure Workload Identity Federation?
- A
Create a workload identity pool in Google Cloud and link it to your external IdP.
- B
Generate and upload a service account key for the workload to use with the external IdP.
- C
Create a workload identity pool provider to map the external IdP’s identity tokens to Google Cloud identities.
- D
Grant the roles/iam.workloadIdentityUser role to the service account being accessed by the workload.
- E
Enable the Workload Identity Federation API in your project.
Show answer and explanation
Correct answers: A, C, D
Explanation
Workload Identity Federation allows your workloads to access Google Cloud resources without needing service account keys, improving security and reducing key management overhead. The correct setup involves creating a workload identity pool and provider to establish a trust relationship with the external IdP. Additionally, the roles/iam.workloadIdentityUser role enables workloads to impersonate service accounts. However, service account keys are not needed, and explicitly enabling the API is unnecessary.
- A. Correct.
Correct: You need to create a workload identity pool in Google Cloud to establish a trust boundary and link it to your external IdP.
- B. Incorrect.
Incorrect: Workload Identity Federation eliminates the need for long-lived service account keys. This step is not required.
- C. Correct.
Correct: A workload identity pool provider must be created to map tokens from the external IdP to identities within the workload identity pool.
- D. Correct.
Correct: The roles/iam.workloadIdentityUser role must be granted to the service account so that workloads can impersonate it.
- E. Incorrect.
Incorrect: While enabling the Workload Identity Federation API is not required, it is implicitly enabled as part of IAM and does not require manual activation.