GCP Associate Cloud Engineer Practice Question

A production project contains the service account [email protected]. Your organization forbids the distribution of long-lived service-account key files. A data engineer needs to execute gcloud commands from her workstation as this service account to launch BigQuery jobs, and she must not receive any broader permissions in the project than are strictly required for impersonation. Which single IAM policy binding will meet these requirements?

Grant the data engineer the Service Account User role (roles/iam.serviceAccountUser) on the bq-runner@analytics-prod service account.
Grant the data engineer the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) at the project level.
Grant the data engineer the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the bq-runner@analytics-prod service account.
Grant the data engineer the Editor role (roles/editor) at the project level.

Report Issue

Answer Description

To let a user obtain short-lived access tokens and act as a service account, you grant that user the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the specific service account. This role lets the principal call the IAM Credentials API (or gcloud … --impersonate-service-account) to generate OAuth 2.0 access tokens for the service account. Granting the role at the service-account resource scope limits the user to impersonating only that account, honoring the least-privilege requirement.

Granting roles/iam.serviceAccountTokenCreator on the entire project would allow impersonation of every service account in the project, providing more access than necessary. The Service Account User role permits attaching a service account to resources but does not allow generating tokens for command-line impersonation. The Editor role is overly permissive and still does not grant token creation for impersonation.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.