GCP Associate Cloud Engineer Practice Question

Your organization runs CI/CD jobs from local developer workstations using the command:

gcloud builds submit --config=cloudbuild.yaml --impersonate-service-account [email protected]

A developer receives the error PERMISSION_DENIED: caller does not have permission to generate access tokens for that service account. You must grant the least-privilege IAM role so the developer can impersonate the service account but cannot manage or attach it to other resources. Which role should you grant on the build-runner service account?

Service Account Token Creator (roles/iam.serviceAccountTokenCreator)
Compute Engine Service Agent (roles/compute.serviceAgent)
Service Account User (roles/iam.serviceAccountUser)
Service Account Admin (roles/iam.serviceAccountAdmin)

Report Issue

Answer Description

Impersonating a service account requires the caller to create short-lived OAuth 2.0 access tokens on behalf of that account. The only role that grants the iam.serviceAccounts.getAccessToken permission without broader administrative capabilities is Service Account Token Creator (roles/iam.serviceAccountTokenCreator).

Service Account User allows attaching a service account to a resource but cannot mint access tokens, so impersonation still fails.
Service Account Admin grants full management of the account, exceeding least-privilege.
Compute Engine Service Agent is a Google-managed role unrelated to impersonation.

Therefore, granting Service Account Token Creator on the specific account lets the developer run the command successfully while limiting scope to token creation.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.