GCP Professional Cloud Architect Practice Question

Your security team forbids storing any service-account key files on your on-premises CI server. You must write a Bash script that, from this server, provisions a regional Standard GKE cluster in each of 15 production projects. The script must run unattended, ensure every API call is attributed to a dedicated deploy-service account in the target project, and must not alter the global gcloud configuration between loop iterations. Which gcloud command structure satisfies these constraints?

gcloud --project=${PROJECT} container clusters create my-cluster --region=us-central1 --impersonate-service-account=deploy-sa@$.iam.gserviceaccount.com --quiet
GOOGLE_CLOUD_PROJECT=$ gcloud container clusters create my-cluster --region=us-central1 --no-user-output-enabled --quiet
export CLOUDSDK_CORE_PROJECT=$ && gcloud container clusters create my-cluster --region=us-central1 --quiet
gcloud config set project $ && gcloud auth activate-service-account --key-file=deploy-sa.json && gcloud container clusters create my-cluster --region=us-central1 --quiet

Report Issue

Answer Description

The --impersonate-service-account flag allows gcloud to obtain a short-lived access token for the specified service account without needing a downloaded key file. Because the flag is supplied on each invocation, it leaves the caller's active configuration unchanged and guarantees that Cloud Audit Logs record the deploy-service account as the principal that performed the action in the target project. Using the --project flag in the same command isolates each loop iteration from global gcloud state. The other options either rely on exported environment variables or gcloud config changes that persist between iterations, or they require a service-account key file, which violates the security requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.