Google Professional Cloud Security Engineer Question 80
Single answerGoogle Cloud PlatformYour organization uses Google Cloud to manage its infrastructure. A developer team needs temporary access to a specific service account to perform maintenance tasks on a Compute Engine instance. As a security best practice, you want to avoid granting the service account's private key to the developers. How should you securely enable the developers to perform their tasks?
- A
Grant the developers the 'Service Account User' role on the service account with the required permissions.
- B
Grant the developers the 'Service Account Token Creator' role on the service account with the required permissions.
- C
Share the service account's private key with the developers and ask them to delete it after the task is complete.
- D
Grant the developers the 'Owner' role at the project level so they have unrestricted access for their tasks.
Show answer and explanation
Correct answer: B
Explanation
To securely enable developers to perform tasks using a service account without exposing its private key, you should use service account impersonation. By granting the 'Service Account Token Creator' role, developers can generate short-lived credentials to impersonate the service account. This approach adheres to Google Cloud's security best practices, minimizes the risk of key exposure, and ensures that permissions are tightly scoped.
- A. Incorrect.
This is incorrect because the 'Service Account User' role allows a user to act as the service account during the execution of a resource, but it does not allow the creation of short-lived credentials or impersonation for temporary tasks.
- B. Correct.
This is correct because the 'Service Account Token Creator' role allows developers to impersonate the service account and generate access tokens for temporary use, aligning with security best practices.
- C. Incorrect.
This is incorrect because sharing the private key increases the risk of exposure and is against Google Cloud's security best practices.
- D. Incorrect.
This is incorrect because granting the 'Owner' role at the project level provides excessive permissions, violating the principle of least privilege.