Google Professional Cloud Security Engineer Question 78
Single answerGoogle Cloud PlatformYour organization uses multiple Google Cloud services, and different teams require access to resources using service accounts. To ensure secure delegation of access, you want to allow a specific team to impersonate a service account without granting them the ability to manage or modify the service account itself. What is the best way to achieve this?
- A
Grant the 'Service Account User' role (roles/iam.serviceAccountUser) on the service account to the team members.
- B
Grant the 'Service Account Admin' role (roles/iam.serviceAccountAdmin) on the service account to the team members.
- C
Grant the 'Service Account Token Creator' role (roles/iam.serviceAccountTokenCreator) on the service account to the team members.
- D
Grant the 'Owner' role (roles/owner) on the service account to the team members.
Show answer and explanation
Correct answer: C
Explanation
To enable secure service account impersonation, the 'Service Account Token Creator' role is the most appropriate choice. It provides just enough permissions to impersonate the service account by creating tokens, without granting the ability to modify or manage the service account. This adheres to the principle of least privilege, ensuring that access is limited to the specific actions required by the team.
- A. Incorrect.
This option is incorrect because the 'Service Account User' role allows users to access resources as the service account, but it does not provide the ability to generate tokens or impersonate the service account.
- B. Incorrect.
This option is incorrect because the 'Service Account Admin' role grants full control over the service account, including the ability to delete or modify it, which is unnecessary and increases the risk of privilege misuse.
- C. Correct.
This option is correct because the 'Service Account Token Creator' role specifically allows users to impersonate a service account by generating tokens that can be used to authenticate as the service account without granting excessive permissions.
- D. Incorrect.
This option is incorrect because the 'Owner' role grants broad permissions, including the ability to manage all resources and permissions for the service account, which is overly permissive and violates the principle of least privilege.