GCP Professional Cloud Security Engineer Practice Question

Your company's security policy forbids keeping long-lived Google Cloud credentials outside Google Cloud. A GitHub Actions workflow builds container images and runs gcloud commands to deploy to a Google Kubernetes Engine (GKE) cluster. Today the workflow authenticates by reading a base-64-encoded JSON key for a user-managed service account that is stored in the repository's secrets. You must eliminate this compliance finding while continuing to deploy from GitHub. Which approach best meets the requirement?

Configure Workload Identity Federation to trust GitHub's OIDC tokens, grant the trusted identity roles/iam.workloadIdentityUser on a dedicated deployer service account, and have the workflow obtain short-lived access tokens at run time.
Move the JSON key to Secret Manager and retrieve it over HTTPS from the workflow so the key is never stored directly in the repository.
Grant the Compute Engine default service account the Editor role, download its private key, and store the key as a GitHub Actions secret for the deployment job.
Encrypt the existing JSON key with a customer-managed key in Cloud KMS, store the encrypted blob in the repository, and decrypt it in the workflow before running gcloud.

Report Issue

Answer Description

Workload Identity Federation lets an external workload-such as a GitHub Actions runner-exchange its native OIDC token for a short-lived Google Cloud access token. Create a Workload Identity Pool and provider that trusts GitHub's OIDC tokens, then grant the pool's principals the role roles/iam.workloadIdentityUser on a dedicated deployer service account. In the workflow, use the google-github-actions/auth action to obtain a short-lived access token and run gcloud without ever storing a long-lived JSON key. Encrypting or vaulting the existing key (the incorrect options) still leaves a long-lived credential outside Google Cloud, and exporting the default service account key with broad permissions both violates least-privilege principles and perpetuates key exposure. Therefore, configuring Workload Identity Federation with the proper IAM role is the only option that fully addresses the policy requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.