An enterprise is designing an automated data ingestion pipeline where external applications running on an on-premises platform need to upload analytics datasets into Google Cloud resources. The security architecture team has established two strict compliance requirements: External workloads must authenticate using short-lived credentials without generating or downloading persistent service account key files. Perimeter security controls must prevent unauthorized data exfiltration to unauthorized Google Cloud resources during and after the data exchange process. Which architecture should you implement to satisfy these security requirements?

Configure Workload Identity Federation to exchange external credentials for short-lived Google Cloud access tokens, and enforce a VPC Service Controls perimeter around the target resources.: ### What Workload Identity Federation and VPC Service Controls Are **Workload Identity Federation** is an identity mechanism that allows workloads running outside Google Cloud (such as on-premises environments or other cloud platforms) to impersonate IAM service accounts and obtain short-lived OAuth 2.0 access tokens using industry-standard protocols like OpenID Connect (OIDC) or SAML 2.0. **VPC Service Controls** is a resource-centric security perimeter capability that defines boundaries around Google Cloud services and APIs to mitigate data exfiltration risks and block unauthorized access from outside trusted perimeters. ### How It Meets the Requirements - **Eliminating Persistent Service Account Keys**: By implementing Workload Identity Federation, on-premises applications use their existing external identity tokens to request temporary, short-lived credentials directly from the Google Cloud Security Token Service. This eliminates the operational overhead and significant security risks associated with downloading, storing, and rotating static service account keys. - **Preventing Data Exfiltration**: Placing the target storage and data processing resources inside a **VPC Service Controls service perimeter** ensures that requests to Google-managed APIs are confined within trust boundaries. Even if credentials are compromised or an unauthorized party attempts to copy data to a storage bucket in an external, attacker-controlled Google Cloud organization, VPC Service Controls intercepts and blocks the exfiltration attempt. ### Key Advantages and Capabilities - **No Stored Cloud Credentials**: Removes long-lived static secrets from external deployment pipelines, internal repositories, and local file systems. - **Granular Context-Aware Perimeter Security**: Restricts access to Google Cloud APIs based on contextual parameters such as IP addresses, access levels, and specific authorized projects. - **Reduced Blast Radius**: Short-lived tokens expire automatically within minutes to hours, drastically narrowing the exposure window of any intercepted credential. - **Auditability and Traceability**: Detailed audit logs capture both external identity assertions and perimeter ingress/egress evaluations for complete visibility. ### Why This Is Optimal Combining **Workload Identity Federation** with **VPC Service Controls** is the recommended architecture for enterprise integrations. It directly resolves the dual challenge of eliminating static credential storage at the identity layer while establishing strict perimeter boundaries that prevent data exfiltration at the network and API layers.

StudyCerts

Workload Identity Federation Vpc Service Controls | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Workload Identity Federation Vpc Service Controls

Section: Integration patterns with external systems

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing an automated data ingestion pipeline where external applications running on an on-premises platform need to upload analytics datasets into Google Cloud resources. The security architecture team has established two strict compliance requirements:

External workloads must authenticate using short-lived credentials without generating or downloading persistent service account key files.
Perimeter security controls must prevent unauthorized data exfiltration to unauthorized Google Cloud resources during and after the data exchange process.

Which architecture should you implement to satisfy these security requirements?

Generate service account keys, store them securely in Secret Manager, and implement Google Cloud Armor security policies to filter incoming API traffic.

Configure Cloud Identity Single Sign-On (SSO) with SAML and apply Access Context Manager access bindings to developer user groups.

Configure Workload Identity Federation to exchange external credentials for short-lived Google Cloud access tokens, and enforce a VPC Service Controls perimeter around the target resources.

Deploy Cloud Service Mesh with Identity-Aware Proxy (IAP) token exchange and restrict communication using Kubernetes Network Policies.

Professional Cloud Architect

Workload Identity Federation Vpc Service Controls

Related questions