Google Professional Cloud Security Engineer Question 79
Single answerGoogle Cloud PlatformYour organization uses Google Cloud to manage its infrastructure. A development team needs temporary access to a service account to perform deployment tasks, but you want to ensure the principle of least privilege is maintained and avoid granting full access to the service account's credentials. How should you configure access?
- A
Grant the development team the 'Service Account User' role on the service account.
- B
Grant the development team the 'Service Account Admin' role on the service account.
- C
Grant the development team the 'Service Account Token Creator' role and allow them to impersonate the service account.
- D
Share the private key of the service account with the development team.
Show answer and explanation
Correct answer: C
Explanation
The 'Service Account Token Creator' role is the correct choice because it allows the development team to generate short-lived tokens and impersonate the service account for the required tasks. This approach ensures the principle of least privilege is maintained and avoids the risks associated with sharing private keys or granting excessive permissions.
- A. Incorrect.
Granting the 'Service Account User' role only allows users to attach the service account to resources, such as Compute Engine instances, but does not allow impersonation or token generation.
- B. Incorrect.
Granting the 'Service Account Admin' role provides excessive permissions, including managing and modifying the service account itself, which violates the principle of least privilege.
- C. Correct.
Granting the 'Service Account Token Creator' role allows the development team to impersonate the service account securely without sharing sensitive credentials, aligning with the principle of least privilege.
- D. Incorrect.
Sharing the private key of the service account is highly discouraged as it exposes sensitive credentials and increases the risk of security breaches.