Workload Identity Federation Trust Service Account Impersonation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise executes automated CI/CD deployment pipelines on an external computing platform. The security architecture team requires that external workloads access Google Cloud resources to deploy infrastructure across multiple projects without using downloadable service account keys. Furthermore, the team mandates that service account impersonation must be strictly restricted to jobs originating from specific repositories and branch references asserted in the external identity provider's token.

Which strategy should the security engineer implement to establish this federation trust relationship?

Configure a Workload Identity Pool and OIDC Workload Identity Provider, define attribute mappings and conditions for repository claims, and grant the Workload Identity User role on the target service account to the specific principalSet.

Deploy Google Cloud Directory Sync (GCDS) on-premises to sync external pipeline identities to Cloud Identity, and grant the Service Account Token Creator role to the synced directory group.

Configure Identity-Aware Proxy (IAP) with Identity Platform external identities and use the signInWithIdp API to exchange external tokens for service account OAuth access tokens.

Generate a service account JSON private key, encrypt it using Cloud Key Management Service (Cloud KMS), and inject the encrypted key ciphertext into the external pipeline runner environment variables.

Professional Cloud Security Engineer

Workload Identity Federation Trust Service Account Impersonation

Related questions