A global enterprise is integrating an external third-party Identity Provider (IdP) with Google Cloud to manage access for external security analysts. The security team has defined several key requirements: Federated users must authenticate directly using their IdP credentials and access Google Cloud resources without provisioning permanent Cloud Identity accounts. Authorization must be granted dynamically based on the external IdP's group assertions. Privilege escalation risks must be minimized by eliminating permanent elevated privileges and avoiding service account impersonation for day-to-day administrative tasks. Which identity and access architecture should the security engineer implement?

Configure a Workforce Identity Federation pool provider mapping `google.subject` and `google.groups` to IdP assertions, grant IAM roles directly to federated principal sets, and use Privileged Access Manager (PAM) for time-bound privilege elevation.: ### What Workforce Identity Federation and PAM Are **Workforce Identity Federation** allows third-party identity providers (such as Okta, Microsoft Entra ID, or SAML 2.0/OIDC-compliant IdPs) to authenticate users directly into Google Cloud without requiring synchronized or managed Cloud Identity accounts. **Privileged Access Manager (PAM)** is an access governance service that manages just-in-time, time-bound privilege elevation with automated workflows and audit logging. ### How It Meets the Requirements - **Direct access without Cloud Identity provisioning:** Workforce Identity Federation creates short-lived STS tokens for federated principals based on incoming assertion tokens, allowing users to access resources using direct principal identifiers. - **Dynamic group-based authorization:** By mapping incoming group claims to the standard `google.groups` attribute in the workforce pool provider configuration (e.g., `google.groups=assertion.attributes.groups`), administrators can grant IAM roles to entire principal groups using `principalSet://iam.googleapis.com/locations/global/workforcePools/.../group/GROUP_NAME`. - **Privilege escalation mitigation:** Instead of relying on broad service account impersonation (`iam.serviceAccounts.actAs` or token generation), PAM enables temporary, scoped role grants that automatically expire and leave detailed audit logs. ### Key Advantages and Capabilities - **Audit transparency:** API requests are logged under the federated principal's individual identity rather than an anonymous shared service account. - **Least privilege enforcement:** Reduces standing access and enforces business justifications and approvals for administrative operations. - **Lifecycle synchronization:** Revoking or updating permissions in the central IdP instantly takes effect during subsequent token exchange operations. ### Why This Is Optimal Direct principal binding combined with PAM provides granular, auditable least privilege while eliminating credential synchronization overhead and avoiding the security risks associated with shared service accounts.

Workforce Identity Federation Scoped Authorization | Professional Cloud Security Engineer

Workforce Identity Federation Scoped Authorization

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A global enterprise is integrating an external third-party Identity Provider (IdP) with Google Cloud to manage access for external security analysts. The security team has defined several key requirements:

Federated users must authenticate directly using their IdP credentials and access Google Cloud resources without provisioning permanent Cloud Identity accounts.
Authorization must be granted dynamically based on the external IdP's group assertions.
Privilege escalation risks must be minimized by eliminating permanent elevated privileges and avoiding service account impersonation for day-to-day administrative tasks.

Which identity and access architecture should the security engineer implement?

Assign Compute Instance Admin roles at the project level and populate instance metadata with external SSH public keys for direct host-level authentication.

Configure a Workforce Identity Federation pool provider mapping google.subject and google.groups to IdP assertions, grant IAM roles directly to federated principal sets, and use Privileged Access Manager (PAM) for time-bound privilege elevation.

Configure Workforce Identity Federation to map all external assertion identities to a shared central service account and grant analysts the Service Account Token Creator role.

Create individual user accounts in Cloud Identity, place analysts into self-managed access groups, and apply overlapping context-aware access bindings across multiple group tiers.

Professional Cloud Security Engineer

Workforce Identity Federation Scoped Authorization

Related questions