GCP Associate Cloud Engineer Practice Question

You are deploying a containerized video-processing application to a GKE cluster that already has Workload Identity enabled. You created a Google service account named video-sa and want pods that run with the Kubernetes service account default in namespace video to download objects from a private Cloud Storage bucket. Which IAM binding is required to let the Kubernetes service account successfully impersonate video-sa through Workload Identity?

Add an IAM binding on the video-sa Google service account giving role roles/iam.serviceAccountTokenCreator to member serviceAccount:PROJECT_ID.svc.id.goog[video/default].
Add an IAM policy binding on the video-sa Google service account that grants role roles/iam.workloadIdentityUser to member serviceAccount:PROJECT_ID.svc.id.goog[video/default].
Grant role roles/serviceAccountUser on the default Kubernetes service account to principal video-sa@PROJECT_ID.iam.gserviceaccount.com.
At the project level, assign roles/storage.objectViewer to member serviceAccount:PROJECT_ID.svc.id.goog[video/default].

Report Issue

Answer Description

Workload Identity works by letting a Kubernetes service account (KSA) act as, or impersonate, a Google service account (GSA). To enable the impersonation you grant the KSA principal the role roles/iam.workloadIdentityUser on the GSA it needs to access. The member string must follow the form serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]. Other roles such as serviceAccountUser or serviceAccountTokenCreator do not allow a KSA to exchange its identity token for a short-lived GSA token, and granting Storage roles to the KSA at project level does not establish the required trust. Therefore the correct action is to add a policy binding on video-sa that gives roles/iam.workloadIdentityUser to serviceAccount:PROJECT_ID.svc.id.goog[video/default].

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.