A global enterprise is integrating an external third-party Identity Provider (IdP) with Google Cloud to manage access for external security analysts. The security team has defined several key requirements: Federated users must authenticate directly using their IdP credentials and access Google Cloud resources without provisioning permanent Cloud Identity accounts. Authorization must be granted dynamically based on the external IdP's group assertions. Privilege escalation risks must be minimized by eliminating permanent elevated privileges and avoiding service account impersonation for day-to-day administrative tasks. Which identity and access architecture should the security engineer implement?

Configure a Workforce Identity Federation pool provider mapping `google.subject` and `google.groups` to IdP assertions, grant IAM roles directly to federated principal sets, and use Privileged Access Manager (PAM) for time-bound privilege elevation.: What Workforce Identity Federation and PAM Are Workforce Identity Federation allows third-party identity providers (such as Okta, Microsoft Entra ID, or SAML 2.0/OIDC-compliant IdPs) to authenticate users directly into Google Cloud without requiring synchronized or managed Cloud Identity accounts. Privileged Access Manager (PAM) is an access governance service that manages just-in-time, time-bound privilege elevation with automated workflows and audit logging. How It Meets the Requirements Direct access without Cloud Identity provisioning: Workforce Identity Federation creates short-lived STS tokens for federated principals based on incoming assertion tokens, allowing users to access resources using direct principal identifiers. Dynamic group-based authorization: By mapping incoming group claims to the standard google.groups attribute in the workforce pool provider configuration (e.g., google.groups=assertion.attributes.groups), administrators can grant IAM roles to entire principal groups using principalSet://iam.googleapis.com/locations/global/workforcePools/.../group/GROUP_NAME. Privilege escalation mitigation: Instead of relying on broad service account impersonation (iam.serviceAccounts.actAs or token generation), PAM enables temporary, scoped role grants that automatically expire and leave detailed audit logs. Key Advantages and Capabilities Audit transparency: API requests are logged under the federated principal's individual identity rather than an anonymous shared service account. Least privilege enforcement: Reduces standing access and enforces business justifications and approvals for administrative operations. Lifecycle synchronization: Revoking or updating permissions in the central IdP instantly takes effect during subsequent token exchange operations. Why This Is Optimal Direct principal binding combined with PAM provides granular, auditable least privilege while eliminating credential synchronization overhead and avoiding the security risks associated with shared service accounts.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Workforce Identity Federation Scoped Authorization

Section: Granting permissions to different types of identities using IAM conditions and IAM deny policies.

A global enterprise is integrating an external third-party Identity Provider (IdP) with Google Cloud to manage access for external security analysts. The security team has defined several key requirements:

Federated users must authenticate directly using their IdP credentials and access Google Cloud resources without provisioning permanent Cloud Identity accounts.
Authorization must be granted dynamically based on the external IdP's group assertions.
Privilege escalation risks must be minimized by eliminating permanent elevated privileges and avoiding service account impersonation for day-to-day administrative tasks.

Which identity and access architecture should the security engineer implement?

Configure Workforce Identity Federation to map all external assertion identities to a shared central service account and grant analysts the Service Account Token Creator role.

Assign Compute Instance Admin roles at the project level and populate instance metadata with external SSH public keys for direct host-level authentication.

Configure a Workforce Identity Federation pool provider mapping google.subject and google.groups to IdP assertions, grant IAM roles directly to federated principal sets, and use Privileged Access Manager (PAM) for time-bound privilege elevation.

Create individual user accounts in Cloud Identity, place analysts into self-managed access groups, and apply overlapping context-aware access bindings across multiple group tiers.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Workforce Identity Federation Scoped Authorization

Section: Granting permissions to different types of identities using IAM conditions and IAM deny policies.

Federated users must authenticate directly using their IdP credentials and access Google Cloud resources without provisioning permanent Cloud Identity accounts.
Authorization must be granted dynamically based on the external IdP's group assertions.
Privilege escalation risks must be minimized by eliminating permanent elevated privileges and avoiding service account impersonation for day-to-day administrative tasks.

Which identity and access architecture should the security engineer implement?

Configure Workforce Identity Federation to map all external assertion identities to a shared central service account and grant analysts the Service Account Token Creator role.

Assign Compute Instance Admin roles at the project level and populate instance metadata with external SSH public keys for direct host-level authentication.

Create individual user accounts in Cloud Identity, place analysts into self-managed access groups, and apply overlapping context-aware access bindings across multiple group tiers.

Explanations

What Workforce Identity Federation and PAM Are

Workforce Identity Federation allows third-party identity providers (such as Okta, Microsoft Entra ID, or SAML 2.0/OIDC-compliant IdPs) to authenticate users directly into Google Cloud without requiring synchronized or managed Cloud Identity accounts. Privileged Access Manager (PAM) is an access governance service that manages just-in-time, time-bound privilege elevation with automated workflows and audit logging.

How It Meets the Requirements

Direct access without Cloud Identity provisioning: Workforce Identity Federation creates short-lived STS tokens for federated principals based on incoming assertion tokens, allowing users to access resources using direct principal identifiers.
Dynamic group-based authorization: By mapping incoming group claims to the standard google.groups attribute in the workforce pool provider configuration (e.g., google.groups=assertion.attributes.groups), administrators can grant IAM roles to entire principal groups using principalSet://iam.googleapis.com/locations/global/workforcePools/.../group/GROUP_NAME.
Privilege escalation mitigation: Instead of relying on broad service account impersonation (iam.serviceAccounts.actAs or token generation), PAM enables temporary, scoped role grants that automatically expire and leave detailed audit logs.

Key Advantages and Capabilities

Audit transparency: API requests are logged under the federated principal's individual identity rather than an anonymous shared service account.
Least privilege enforcement: Reduces standing access and enforces business justifications and approvals for administrative operations.
Lifecycle synchronization: Revoking or updating permissions in the central IdP instantly takes effect during subsequent token exchange operations.

Why This Is Optimal

Direct principal binding combined with PAM provides granular, auditable least privilege while eliminating credential synchronization overhead and avoiding the security risks associated with shared service accounts.

View source documentation

Professional Cloud Security Engineer

Workforce Identity Federation Scoped Authorization

Professional Cloud Security Engineer

Workforce Identity Federation Scoped Authorization

What Workforce Identity Federation and PAM Are

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions