A security engineer is configuring Workforce Identity Federation to grant external security analysts access to Google Cloud resources in a project named analytics-prod. The identity provider (IdP) is integrated via an organization-level workforce pool named corp-analysts-pool. The engineer must satisfy the following requirements: Grant the Storage Object Viewer role (roles/storage.objectViewer) to all users belonging to the IdP group sec-analysts. Ensure that all federated web console and Google Cloud CLI sessions, as well as generated access tokens, automatically expire after 4 hours (14,400 seconds). Which configuration should the security engineer apply?

Grant the role on analytics-prod to the member identifier principalSet://iam.googleapis.com/locations/global/workforcePools/corp-analysts-pool/group/sec-analysts, and configure the --session-duration=14400s setting on the corp-analysts-pool workforce identity pool.: ### What Workforce Identity Pool Principal Sets and Session Durations Are **Workforce Identity Federation** allows users managed in an external IdP (such as Microsoft Entra ID or Okta) to access Google Cloud resources directly without synchronizing user accounts into Cloud Identity. Group-based access is granted by referencing the mapped `google.groups` attribute using a specific `principalSet://` resource identifier format under the organization-scoped workforce identity pool. The **session duration** setting manages the credential lifecycle and controls how long federated sessions and security tokens remain valid. ### How It Meets the Requirements - **Group role binding:** To grant access to an entire IdP group mapped to `google.groups`, IAM requires the `principalSet://` prefix targeting the workforce pool resource path followed by `/group/GROUP_ID`. Specifically, `principalSet://iam.googleapis.com/locations/global/workforcePools/corp-analysts-pool/group/sec-analysts` ensures all analysts within that group inherit `roles/storage.objectViewer` on `analytics-prod`. - **Session lifecycle management:** Configuring `--session-duration=14400s` (4 hours) at the **workforce identity pool level** directly governs the maximum lifetime of issued Google Cloud access tokens, federated web console sign-in sessions, and `gcloud` CLI sessions. Google Cloud supports workforce pool session durations between 15 minutes (`900s`) and 12 hours (`43200s`), making 14,400 seconds valid. ### Key Advantages and Capabilities - **Syncless group governance:** Allows administrators to manage team membership dynamically in the upstream identity provider without provisioning Google Accounts. - **Unified credential lifecycle:** Enforces uniform session expiration across both graphical user interface (console) and programmatic (`gcloud` CLI) access pathways. - **Organization-level scoping:** Workforce pools are globally identified at the organization level (`locations/global/workforcePools/`), avoiding hardcoded project numbers in member identifiers. - **Least privilege:** Session limits minimize the exposure window if a federated token or workstation session is compromised. ### Why This Is Optimal This approach uses the exact workforce pool principal identifier syntax and leverages the native `--session-duration` parameter on the workforce pool resource to enforce access boundaries and credential lifecycles cleanly.

Workforce Pool Iam Role Session Duration | Professional Cloud Security Engineer

Workforce Pool Iam Role Session Duration

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is configuring Workforce Identity Federation to grant external security analysts access to Google Cloud resources in a project named analytics-prod. The identity provider (IdP) is integrated via an organization-level workforce pool named corp-analysts-pool.

The engineer must satisfy the following requirements:

Grant the Storage Object Viewer role (roles/storage.objectViewer) to all users belonging to the IdP group sec-analysts.
Ensure that all federated web console and Google Cloud CLI sessions, as well as generated access tokens, automatically expire after 4 hours (14,400 seconds).

Which configuration should the security engineer apply?

Grant the role on analytics-prod to the member identifier group:sec-analysts@corp-analysts-pool.iam.gserviceaccount.com, and configure the --session-duration=14400s parameter on the workforce identity pool provider.

Grant the role on analytics-prod to the member identifier principalSet://iam.googleapis.com/locations/global/workforcePools/corp-analysts-pool/group/sec-analysts, and configure the --session-duration=14400s setting on the corp-analysts-pool workforce identity pool.

Grant the role on analytics-prod to the member identifier principal://iam.googleapis.com/locations/global/workforcePools/corp-analysts-pool/group/sec-analysts, and enforce the constraints/iam.allowServiceAccountCredentialLifetimeExtension organization policy constraint set to 4 hours.

Grant the role on analytics-prod to the member identifier principalSet://iam.googleapis.com/projects/123456789012/locations/global/workloadIdentityPools/corp-analysts-pool/group/sec-analysts, and configure the --service-account-token-lifetime-seconds=14400 flag on the pool provider credential configuration.

Professional Cloud Security Engineer

Workforce Pool Iam Role Session Duration

Related questions