Configure Iam Least Privilege Service Account Impersonation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise data engineering team operates an automated CI/CD pipeline in project-dev-cicd that deploys and executes nightly ETL workflows in project-analytics-prod. The pipeline must read source files from a dedicated Cloud Storage bucket and write processed tables into a specific BigQuery dataset in the analytics project.

Corporate security policy strictly forbids downloading and storing long-lived service account JSON keys and mandates least-privilege resource scoping.

How should you configure Cloud IAM and service account permissions to fulfill these requirements?

Create a dedicated service account in project-analytics-prod with the basic roles/editor role. Grant the CI/CD pipeline service account the roles/iam.serviceAccountUser role on project-analytics-prod.

Grant the CI/CD pipeline service account roles/bigquery.admin and roles/storage.admin directly at the project level in project-analytics-prod using cross-project IAM bindings.

Create a dedicated service account in project-analytics-prod, export a service account JSON key file, and store it encrypted in Secret Manager. Grant the pipeline service account roles/secretmanager.secretAccessor.

Create a dedicated service account in project-analytics-prod. Grant it roles/storage.objectViewer on the bucket, roles/bigquery.dataEditor on the target dataset, and roles/bigquery.jobUser on the project. Grant the pipeline service account roles/iam.serviceAccountTokenCreator on the dedicated service account.

Professional Cloud Data Engineer

Configure Iam Least Privilege Service Account Impersonation

Related questions