GCP Professional Cloud Security Engineer Practice Question

Your organization's GitHub Actions pipeline builds container images and pushes them to Artifact Registry in a Google Cloud project. The workflow currently authenticates with a JSON key for a user-managed service account, but new policy mandates that no long-lived Google-issued credential may exist outside Google Cloud. Short-lived OAuth 2.0 access tokens (≤1 hour) must be generated just-in-time from the workflow without human interaction. Which solution best meets these requirements while respecting least privilege?

Place Artifact Registry into a VPC Service Controls perimeter and add the GitHub runners' IP range to an access level, removing the need for service account credentials during image pushes.
Create a workload identity pool with a GitHub OIDC provider and allow the pool to impersonate a minimally scoped service account, so the workflow exchanges its GitHub OIDC token for a short-lived Google Cloud access token at runtime.
Store the existing JSON service-account key in Secret Manager and configure the workflow to fetch the key at runtime, rotating the key every seven days with Cloud Scheduler.
Run gcloud auth application-default login locally, commit the generated Application Default Credentials file that contains a refresh token, and let the workflow exchange the refresh token for one-hour access tokens when needed.

Report Issue

Answer Description

Workload Identity Federation lets external workloads (including GitHub Actions) exchange an external OIDC token for a short-lived Google Cloud access token, eliminating the need to store a service-account key. When you create a workload identity pool and a GitHub provider, GitHub issues an OIDC token at build time that Google's Security Token Service exchanges for an access token valid for up to one hour. Granting the pool permission to impersonate a narrowly scoped service account maintains least privilege. Using a gcloud-generated refresh token would leave a long-lived credential in the repository, violating policy. VPC Service Controls protect against data exfiltration but do not provide authentication. Storing and rotating the JSON key in Secret Manager still relies on a long-lived key and does not meet the short-lived-credential requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.