Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ255

Designing for security and compliance

JencoMart has chosen to migrate user-profile storage to Google Cloud Datastore and its application servers to Google Compute Engine (GCE). During the migration, the existing infrastructure will require access to Datastore to upload the data.

Which service-account key-management strategy should you recommend?

  • A Provision service account keys for the on-premises infrastructure and for the GCE virtual machines (VMs)
  • B Authenticate the on-premises infrastructure with a user account and provision service account keys for the VMs
  • C Provision service account keys for the on-premises infrastructure and use Google Cloud Platform (GCP) managed keys for the VMs
  • D Deploy a custom authentication service on GCE/Google Kubernetes Engine (GKE) for the on-premises infrastructure and use GCP managed keys for the VMs
Explanation

Infrastructure running outside Google Cloud requires a service account credential to authenticate to Google Cloud APIs; in this set of options, that is a user-managed service account key. Applications on Compute Engine VMs should use an attached service account, whose credentials are generated with Google-managed keys rather than embedding exported private keys in the VM. Google recommends attached service accounts for VM workloads and documents that Compute Engine uses Google-owned and managed key pairs to generate short-lived service account credentials.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!