An enterprise is designing a hybrid cloud architecture where external on-premises applications must access Google Cloud resources securely without using downloadable service account keys. The compliance and security teams establish the following technical requirements: External applications must authenticate via Workload Identity Federation using stable, non-reusable identity attributes to prevent unauthorized access via identity spoofing. The security operations team must maintain a non-repudiable audit trail capable of tracing all service account impersonation events directly back to the original external principal. Attribute mapping configurations must be protected against unauthorized modifications by applying the principle of least privilege. Which combination of architectural and IAM practices should the cloud architect recommend?

Map federation attributes using immutable user identifiers, enable Data Access audit logs for both the Security Token Service API and IAM API, and restrict the IAM Workload Identity Pool Admin role to authorized administrators.: ### What Workload Identity Federation Best Practices Entail **Workload Identity Federation** allows external workloads (such as on-premises applications or systems hosted in other clouds) to impersonate **Google Cloud service accounts** using short-lived credentials derived from **Security Token Service (STS)** tokens, eliminating the risks associated with downloadable service account keys. ### How It Meets the Requirements - **Preventing Identity Spoofing**: Mapping federation attributes to unique, immutable, and authoritative user IDs (rather than mutable usernames or reusable email addresses) ensures that if an identity profile changes or is recreated in the external provider, unintended permissions are not inherited. - **Non-Repudiable Audit Trail**: Enabling **Data Access audit logs** for both the **Security Token Service API** and the **Identity and Access Management API** captures the external caller's subject identity inside the `serviceAccountDelegationInfo` metadata, providing complete end-to-end traceability for forensic analysis. - **Least Privilege Management**: Restricting the **IAM Workload Identity Pool Admin** (`roles/iam.workloadIdentityPoolAdmin`) role ensures that only authorized administrators can modify attribute mappings, preventing malicious actors from altering translation rules to gain unauthorized access. ### Key Advantages - **Elimination of Long-Lived Secrets**: Avoids storing, rotating, and securing service account JSON keys on on-premises infrastructure. - **Authoritative Attribute Mapping**: Mitigates impersonation and privilege escalation attacks caused by mutable identity attributes. - **Comprehensive Forensics**: Supplies the necessary log fields in **Cloud Audit Logs** to correlate Google Cloud actions with external identity provider event logs. - **Granular Access Control**: Isolates workload pool administrative permissions to dedicated security administrators. ### Why This Is Optimal This architecture establishes zero-trust identity federation while strictly fulfilling organizational compliance, least privilege governance, and end-to-end non-repudiation requirements.

StudyCerts

Workload Identity Federation Audit Least Privilege | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Workload Identity Federation Audit Least Privilege

Section: Familiarity with the Google Cloud Well-Architected Framework

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a hybrid cloud architecture where external on-premises applications must access Google Cloud resources securely without using downloadable service account keys. The compliance and security teams establish the following technical requirements:

External applications must authenticate via Workload Identity Federation using stable, non-reusable identity attributes to prevent unauthorized access via identity spoofing.
The security operations team must maintain a non-repudiable audit trail capable of tracing all service account impersonation events directly back to the original external principal.
Attribute mapping configurations must be protected against unauthorized modifications by applying the principle of least privilege.

Which combination of architectural and IAM practices should the cloud architect recommend?

Map federation attributes using external corporate email addresses, rely exclusively on default Admin Activity audit logs, and assign the Owner role to application developers on the workload identity pool project.

Map federation attributes using immutable user identifiers, enable Data Access audit logs for both the Security Token Service API and IAM API, and restrict the IAM Workload Identity Pool Admin role to authorized administrators.

Configure Workload Identity Federation using SAML group assertions mapped to primitive Editor roles, disable Data Access logs to optimize cost, and grant all engineers the Workload Identity Pool Admin role.

Generate long-lived service account keys, store them securely in Secret Manager for on-premises access, and assign the Service Account Key Admin role to developers.

Professional Cloud Architect

Workload Identity Federation Audit Least Privilege

Related questions