Google Professional Cloud Security Engineer Question 81
Select 3Google Cloud PlatformYou are a Cloud Security Engineer tasked with enabling a Compute Engine instance to access a Cloud Storage bucket without using its own service account key. Instead, you decide to use service account impersonation to enhance security. Which steps should you take to properly configure service account impersonation?
- A
Grant the 'roles/iam.serviceAccountTokenCreator' role to the Compute Engine instance's service account on the target service account.
- B
Grant the 'roles/storage.objectViewer' role to the Compute Engine instance's service account on the Cloud Storage bucket.
- C
Grant the 'roles/storage.objectViewer' role to the target service account on the Cloud Storage bucket.
- D
Update the Compute Engine instance to use the target service account directly by assigning it in the configuration.
- E
Configure the Compute Engine instance to request temporary credentials via the
generateAccessTokenAPI for impersonating the target service account.
Show answer and explanation
Correct answers: A, C, E
Explanation
Service account impersonation enhances security by avoiding the need to manage and distribute service account keys. To enable a Compute Engine instance to access resources via impersonation, you must grant the 'roles/iam.serviceAccountTokenCreator' role to the instance's service account on the target service account, give the target service account appropriate permissions for the resource, and ensure the instance requests temporary credentials using APIs such as generateAccessToken. This approach aligns with best practices for least privilege and keyless authentication.
- A. Correct.
Correct: The 'roles/iam.serviceAccountTokenCreator' role is required to allow the Compute Engine instance's service account to impersonate the target service account.
- B. Incorrect.
Incorrect: Granting this role directly to the Compute Engine instance's service account does not follow the principle of least privilege and is not necessary when using service account impersonation.
- C. Correct.
Correct: The target service account needs the appropriate permissions (e.g., 'roles/storage.objectViewer') on the Cloud Storage bucket to perform the desired actions.
- D. Incorrect.
Incorrect: Directly assigning the target service account to the Compute Engine instance bypasses the benefit of service account impersonation and is less secure.
- E. Correct.
Correct: The Compute Engine instance must request temporary credentials via the
generateAccessTokenAPI to impersonate the target service account.