GCP Professional Cloud Security Engineer Practice Question

Your security team wants to eliminate the long-lived Google Cloud service account keys currently stored as Kubernetes secrets in an AWS EKS cluster. The applications running in that cluster must still upload objects to a Cloud Storage bucket in your Google Cloud project. You need a solution that follows Google's recommended practices, keeps credentials short-lived, and minimizes operational overhead. What should you do?

Generate a new user-managed service account key, encrypt it with AWS KMS, store it in AWS Secrets Manager, and decrypt it at container start-up.
Make the Cloud Storage bucket public and require the application to use signed URLs produced by a helper service in Google Cloud for uploads.
Enable GKE Workload Identity in the Google Cloud project and label the EKS pods with the target Google service account to transparently obtain tokens.
Create a Workload Identity Pool with an AWS provider, map the EKS cluster's IAM role to a Google Cloud service account with the required Storage roles, and let workloads obtain short-lived tokens through Application Default Credentials.

Report Issue

Answer Description

The recommended pattern is to adopt Workload Identity Federation. By creating a workload identity pool with an AWS provider, you can establish trust between specific AWS IAM roles and a Google Cloud service account. The application running in EKS exchanges its AWS temporary credentials for short-lived OAuth 2.0 access tokens tied to the Google service account, eliminating the need to create, distribute, or store user-managed service account keys. Google Kubernetes Engine's Workload Identity only works for GKE clusters, not EKS. Encrypting and distributing a new key still relies on long-lived credentials and adds operational burden. Making the bucket public and relying on signed URLs both exposes data and bypasses IAM, violating least-privilege principles.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.