Your organization uses an external CI/CD pipeline running in an external cloud provider to deploy application infrastructure. The pipeline needs to decrypt sensitive deployment configuration files using a Cloud KMS key before initiating rollout. To meet strict security compliance, your implementation must satisfy the following requirements: Eliminate long-lived service account keys by using Workload Identity Federation Enforce the principle of least privilege on Cloud KMS resources Prevent identity spoofing by mapping stable, non-reusable external claims Maintain a non-repudiable audit trail for all federated impersonation events Which configuration should you implement?

Configure a Workload Identity Pool mapping stable external claims, grant the federated identity roles/iam.workloadIdentityUser on a dedicated service account, grant that service account roles/cloudkms.cryptoKeyDecrypter specifically on the target CryptoKey, and enable Data Access audit logs for the Security Token Service and IAM APIs.: ### What this solution is This architecture establishes a secure, keyless authentication bridge between external CI/CD pipeline runners and Google Cloud resources by combining **Workload Identity Federation (WIF)**, fine-grained **Cloud Key Management Service (Cloud KMS)** access control, and comprehensive **Cloud Audit Logging**. ### How it meets the requirements - **Eliminate long-lived keys**: External runners exchange their short-lived OpenID Connect (OIDC) tokens for Google Cloud credentials using Workload Identity Federation instead of downloading exportable JSON service account keys. - **Least privilege access**: Granting `roles/cloudkms.cryptoKeyDecrypter` strictly at the individual **CryptoKey** level (rather than across the entire KeyRing or project) ensures the service account can only decrypt payloads without having permissions to encrypt, destroy, or manage key configurations. - **Prevent identity spoofing**: Mapping stable, immutable attributes (such as unique external issuer subject IDs or repository IDs) rather than mutable attributes (such as runner names or emails) prevents deleted or reassigned external identities from gaining unauthorized access. - **Non-repudiation**: Enabling **Data Access audit logs** for both the **Security Token Service (STS) API** and the **Identity and Access Management (IAM) API** ensures all token exchange and service account impersonation events capture the external caller's subject in the audit trail. ### Key advantages - Limits the security blast radius to a single cryptographic key. - Avoids key management overhead and rotation risks associated with static credentials. - Ensures full traceability across the identity provider and Google Cloud audit logs. - Enforces separation of duties between key administration and cryptographic operations.

Workload Identity Federation Kms Least Privilege Audit | Professional Cloud DevOps Engineer

Workload Identity Federation Kms Least Privilege Audit

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization uses an external CI/CD pipeline running in an external cloud provider to deploy application infrastructure. The pipeline needs to decrypt sensitive deployment configuration files using a Cloud KMS key before initiating rollout.

To meet strict security compliance, your implementation must satisfy the following requirements:

Eliminate long-lived service account keys by using Workload Identity Federation
Enforce the principle of least privilege on Cloud KMS resources
Prevent identity spoofing by mapping stable, non-reusable external claims
Maintain a non-repudiable audit trail for all federated impersonation events

Which configuration should you implement?

Generate a downloadable JSON service account key for a deployment service account, assign it roles/cloudkms.cryptoKeyDecrypter at the project level, and enable Security Command Center audit alerting.

Create a service account with roles/cloudkms.admin on the target CryptoKey, assign the pipeline runner roles/iam.workloadIdentityPoolAdmin on the project, and export audit logs to BigQuery.

Configure a Workload Identity Pool mapping external usernames, grant the federated principal roles/cloudkms.cryptoKeyEncrypterDecrypter on the parent KeyRing, and enable default Cloud Logging for Cloud KMS.

Configure a Workload Identity Pool mapping stable external claims, grant the federated identity roles/iam.workloadIdentityUser on a dedicated service account, grant that service account roles/cloudkms.cryptoKeyDecrypter specifically on the target CryptoKey, and enable Data Access audit logs for the Security Token Service and IAM APIs.

Professional Cloud DevOps Engineer

Workload Identity Federation Kms Least Privilege Audit

Related questions