A security engineer is designing a credential delegation workflow for an automated pipeline that impersonates a privilege-bearing service account using the IAM Service Account Credentials API (iamcredentials.googleapis.com). The pipeline must generate specific short-lived credentials to fulfill three separate operational requirements: Authenticate service-to-service requests to an internal microservice hosted on Cloud Run. Enable an external partner to upload a diagnostic bundle directly to a Cloud Storage bucket via an HTTP PUT request without providing them Google credentials. Make programmatic administrative calls to standard Google Cloud REST APIs. Which combination of IAM Service Account Credentials API methods and short-lived credential types should the engineer use?

1. Call `generateIdToken` to produce an OpenID Connect (OIDC) ID token with the target audience claim. 2. Call `signBlob` to sign the payload required for a Cloud Storage signed URL. 3. Call `generateAccessToken` to produce an OAuth 2.0 access token with appropriate OAuth scopes.: ### What each credential type is and does Each short-lived credential format generated by the **IAM Service Account Credentials API** (`iamcredentials.googleapis.com`) is tailored for specific authentication, authorization, and cryptographic use cases across Google Cloud. ### How this configuration meets the requirements - **Cloud Run authentication:** Services hosted on serverless platforms such as **Cloud Run** or **Cloud Run functions**, as well as endpoints secured by **Identity-Aware Proxy (IAP)**, require Google-signed **OpenID Connect (OIDC) ID tokens**. Calling the `generateIdToken` method generates a signed JSON Web Token (JWT) containing an `aud` (audience) claim matching the target service URL. - **External Cloud Storage upload:** Creating a **Cloud Storage signed URL** requires creating a cryptographic signature over canonical HTTP request elements (such as HTTP verb, MD5, expiration, and resource path). The `signBlob` method uses the service account's Google-managed private key held in escrow to sign the arbitrary payload without exporting or exposing the private key. - **Standard Google Cloud REST APIs:** Google Cloud resource management and infrastructure APIs accept **OAuth 2.0 access tokens** as bearer tokens in the HTTP `Authorization: Bearer ` header. Calling `generateAccessToken` creates a temporary, short-lived OAuth 2.0 access token restricted by requested OAuth scopes. ### Key advantages of this approach - **Elimination of long-lived service account keys:** All tokens and signatures are generated on-demand via IAM delegation and service account impersonation. - **Audience restriction:** The OIDC ID token is restricted to the specific target service via its `aud` claim, preventing replay attacks against other services. - **Least privilege:** Cryptographic signing via `signBlob` delegates time-bounded bucket access to external parties without granting them IAM roles or service account credentials.

Iam Service Account Credentials Token Types | Professional Cloud Security Engineer

Iam Service Account Credentials Token Types

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing a credential delegation workflow for an automated pipeline that impersonates a privilege-bearing service account using the IAM Service Account Credentials API (iamcredentials.googleapis.com). The pipeline must generate specific short-lived credentials to fulfill three separate operational requirements:

Authenticate service-to-service requests to an internal microservice hosted on Cloud Run.
Enable an external partner to upload a diagnostic bundle directly to a Cloud Storage bucket via an HTTP PUT request without providing them Google credentials.
Make programmatic administrative calls to standard Google Cloud REST APIs.

Which combination of IAM Service Account Credentials API methods and short-lived credential types should the engineer use?

Call signJwt to produce a custom JWT containing user identity claims for Cloud Run.
Call generateAccessToken with Credential Access Boundaries to create the upload URL.
Call signBlob to sign individual REST API requests for infrastructure management.

Call generateAccessToken with the Cloud Run URL supplied as the OAuth scope.
Call signJwt to construct a signed storage claim for the HTTP PUT operation.
Call generateIdToken to authenticate calls to Google Cloud REST APIs.

Call generateIdToken with the cloud-platform OAuth scope.
Call generateAccessToken to sign the Cloud Storage HTTP PUT query parameters.
Call generateIdToken with the audience set to https://cloudresourcemanager.googleapis.com.

Call generateIdToken to produce an OpenID Connect (OIDC) ID token with the target audience claim.
Call signBlob to sign the payload required for a Cloud Storage signed URL.
Call generateAccessToken to produce an OAuth 2.0 access token with appropriate OAuth scopes.

Professional Cloud Security Engineer

Iam Service Account Credentials Token Types

Related questions