GCP Professional Cloud Security Engineer Practice Question

A compliance review discovers that an AWS Lambda function keeps a long-lived JSON key for the [email protected] account in AWS Secrets Manager. The key lets the function upload CSV files to a single Cloud Storage bucket in the production project. Security mandates removal of any stored keys, use of short-lived credentials, and adherence to the principle of least privilege. Which solution best satisfies all requirements while minimally refactoring the Lambda code?

Enable HMAC access for Cloud Storage, create an access key pair for the existing service account, store the keys in AWS Secrets Manager, and restrict uploads with object-level ACLs.
Create a workload identity pool with an AWS provider that trusts a designated IAM role used by the Lambda function. Map the role to a new service account that has only the Storage Object Creator role on the required bucket, then update the function to request federated tokens at runtime.
Generate a new user-managed service account key with a 24-hour rotation schedule in AWS Secrets Manager and update the Lambda environment variables to reference the rotating secret.
Establish VPC peering between AWS and Google Cloud and deploy a Compute Engine proxy VM with the existing service account attached; configure the Lambda function to SCP files through the proxy to the bucket.

Report Issue

Answer Description

Workload Identity Federation allows external workloads such as an AWS Lambda function to exchange their native cloud credentials for short-lived Google Cloud access tokens, eliminating the need to store a user-managed service account key. By creating a workload identity pool and an AWS provider that trusts a specific IAM role, you can map that role to a dedicated Google Cloud service account. Granting the service account the Storage Object Creator role on only the target bucket enforces least privilege. When the Lambda function assumes the trusted AWS role it automatically receives a signed identity token, which the Security Token Service exchanges for a temporary access token to impersonate the service account and write objects. The other options either continue to rely on long-lived keys, introduce unnecessary infrastructure, or use HMAC credentials that must still be stored and rotated, so they do not meet the stated security objectives.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.