Enforce Keyless Org Policy Workload Identity Federation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise security team wants to harden their Google Cloud environment by eliminating long-lived, user-managed service account keys. The team must enforce guardrails across the entire resource hierarchy to prevent developers from creating new service account keys or uploading external public keys. In addition, an external application running outside Google Cloud must be able to securely authenticate and access Google Cloud resources using short-lived credentials rather than static key files.

Which set of actions should the security team implement?

Enforce the iam.allowedPolicyMemberDomains organization policy constraint at the project level, and configure Cloud Key Management Service (Cloud KMS) to generate asymmetric keypairs for external client signing.

Enforce the iam.automaticGrantsForDefaultServiceAccounts organization policy constraint at the organization root, and grant the Service Account User role (roles/iam.serviceAccountUser) to the external workload.

Enforce the iam.disableServiceAccountKeyCreation and iam.disableServiceAccountKeyUpload organization policy constraints at the organization root, and configure Workload Identity Federation with the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to generate short-lived credentials for the external workload.

Configure the iam.serviceAccountKeyExposureResponse organization policy constraint at the organization root, and grant the Pub/Sub Publisher role (roles/pubsub.publisher) to the external service account.

Professional Cloud Security Engineer

Enforce Keyless Org Policy Workload Identity Federation

Related questions