Google Professional Machine Learning Engineer Question 428
Single answerGoogle Cloud PlatformYour organization has implemented a CI/CD pipeline using Jenkins for deploying machine learning models to Google Cloud. During the deployment step, the pipeline fails due to authentication issues when Jenkins attempts to deploy the model to AI Platform. Which solution would BEST resolve this issue while adhering to Google Cloud security best practices?
- A
Create and use a service account key file, upload it to Jenkins, and configure the pipeline to use the key file for authentication.
- B
Grant the 'Owner' IAM role to the Jenkins server's default Compute Engine service account.
- C
Use the Workload Identity Federation feature to allow Jenkins to impersonate a Google Cloud service account.
- D
Manually authenticate Jenkins using the
gcloud auth logincommand before each pipeline run.
Show answer and explanation
Correct answer: C
Explanation
The best solution is to use Workload Identity Federation, which eliminates the need to manage service account keys and provides a secure way to allow Jenkins to authenticate and interact with Google Cloud resources. This approach adheres to Google Cloud's security best practices by reducing the risk of key compromise and ensuring a more automated, scalable authentication process.
- A. Incorrect.
Using a service account key file is not recommended because storing and managing key files increases the risk of security breaches. This approach does not align with Google Cloud's best practices.
- B. Incorrect.
Granting the 'Owner' role is excessive and violates the principle of least privilege. It poses a significant security risk by giving Jenkins access to all resources in the project.
- C. Correct.
Workload Identity Federation allows external systems like Jenkins to securely access Google Cloud resources without the need to manage long-lived service account keys. This approach aligns with Google Cloud security best practices.
- D. Incorrect.
Manually authenticating Jenkins with
gcloud auth loginis not practical for automated pipelines and does not follow security best practices for CI/CD workflows.