Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise organization is designing an automated workflow and developer access model for querying sensitive data across projects. The enterprise security policy strictly forbids generating, downloading, and storing long-lived, static service account private JSON keys due to exfiltration risks.
You need to configure access so that authorized engineers and automated services can dynamically obtain short-lived OAuth2 access tokens to execute tasks with the permissions of a designated workload service account.
Which IAM role configuration should you implement?
The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) grants principals the permissions necessary to impersonate a service account directly and generate short-lived credentials, including OAuth 2.0 access tokens, OpenID Connect (OIDC) ID tokens, and signed JSON Web Tokens (JWTs).
StudyCerts
StudyCertsgenerateAccessToken) by the original principal and the subsequent actions taken by the impersonated service account.gcloud --impersonate-service-account), client libraries, Terraform, and cloud-native services.Service account impersonation via the Service Account Token Creator role is Google Cloud's recommended architectural best practice for temporary privilege escalation and automated access without static credential overhead.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.