Workload Identity Federation Token Lifetime Extension

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise runs long-running batch analytics jobs on Amazon Web Services (AWS) EC2 instances that process and load data directly into Google Cloud BigQuery and Cloud Storage. The security team identified that developers are currently using downloaded, long-lived service account JSON keys on AWS, violating corporate security policies.

The security engineer must replace these static keys with Workload Identity Federation using AWS instance profiles. The batch pipeline runs for 4 consecutive hours, requiring a single short-lived impersonated service account token with a 4-hour (14,400-second) lifetime.

Which set of actions should the security engineer take to implement this architecture?

Configure a Workload Identity Pool with an AWS provider, generate the credential configuration file specifying --service-account-token-lifetime-seconds 14400, grant the external principal the roles/iam.workloadIdentityUser role on the target service account, and add the service account to the constraints/iam.allowServiceAccountCredentialLifetimeExtension organization policy constraint.

Generate the credential configuration file with --service-account-token-lifetime-seconds 14400, configure the AWS Workload Identity Pool, and apply the constraints/iam.disableServiceAccountKeyCreation organization policy to automatically extend the maximum token lifetime.

Configure Workforce Identity Federation with an OIDC provider, set the workforce pool session duration to 14,400 seconds, and use gcloud auth application-default login --login-config to authenticate the automated AWS EC2 batch workload.

Create a Workload Identity Pool and AWS provider, configure the AWS credentials in Google Cloud Secret Manager, set an automatic 4-hour Cloud Functions rotation trigger, and grant the Secret Accessor role to the AWS EC2 instance profile.

Professional Cloud Security Engineer

Workload Identity Federation Token Lifetime Extension

Related questions