Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ152

Configuring access

Your organization is moving its primary web application from on-premises infrastructure to Google Kubernetes Engine (GKE). You need to advise the development team how to give applications running within GKE access to Google Cloud services in accordance with security best practices. What should you recommend that the development team do?

  • A Configure the GKE nodes to use the default Compute Engine service account.
  • B Enable Workload Identity for GKE. Assign a Kubernetes service account to the application and configure that Kubernetes service account to act as an Identity and Access Management (IAM) service account. Grant the required roles to the IAM service account.
  • C Create a user-managed service account with only the roles required for the specific workload. Assign this service account to the GKE nodes.
  • D Create an application-specific IAM service account and generate a user-managed service account key for it. Inject the key to the workload by storing it as a Kubernetes secret within the same namespace as the application.
Explanation

Workload Identity Federation for GKE is the recommended authentication method for GKE workloads accessing Google Cloud services. It provides a distinct, fine-grained identity for the application and permits least-privilege IAM role assignment without sharing the node service account or distributing long-lived service account keys in Kubernetes Secrets.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!