Google Professional Cloud Security Engineer Question 82
Single answerGoogle Cloud PlatformYour company uses a Google Cloud project where multiple applications need to access a specific service account to perform operations on Cloud Storage. To improve security, you want to reduce the risk of exposing the private key of the service account while still allowing applications to authenticate and perform necessary actions. What is the best approach to achieve this?
- A
Grant the applications the 'Service Account User' role on the required service account and use service account impersonation.
- B
Download the service account's private key and distribute it to the applications to authenticate directly.
- C
Grant the applications direct 'Storage Admin' permissions on the Cloud Storage buckets they need to access.
- D
Grant the applications the 'Storage Viewer' role and use a shared service account only when elevated permissions are required.
Show answer and explanation
Correct answer: A
Explanation
Service account impersonation is a secure method to allow applications to act as a service account without directly handling its private key. By granting the 'Service Account User' role, applications can request short-lived credentials to perform actions on behalf of the service account, reducing the risk of credential exposure and adhering to security best practices.
- A. Correct.
Correct: Granting the 'Service Account User' role to the applications allows them to impersonate the service account securely without exposing the private key. Service account impersonation ensures that the applications can perform actions as the service account without directly handling sensitive credentials.
- B. Incorrect.
Incorrect: Distributing private keys increases the risk of credential leakage or misuse. This approach is discouraged for security reasons.
- C. Incorrect.
Incorrect: Granting direct 'Storage Admin' permissions to the applications violates the principle of least privilege and does not leverage service account impersonation for secure access.
- D. Incorrect.
Incorrect: Granting 'Storage Viewer' permissions and using a shared service account is not a recommended approach. This creates potential for overprivileged access and unnecessary complexity.