Google Associate Cloud EngineerConfiguring access and securityHard
A team is developing a highly sensitive application that requires a dedicated service account to interact with Google Cloud APIs. Due to strict security policies, the service account must not have any directly downloadable key files. Instead, it needs to authenticate using a short-lived credential that is automatically rotated by Google Cloud. Which type of service account key should be used?
- AGoogle-managed service account key
- BExternal service account key
- CSSH key for service account
- DUser-managed service account key
Show answer & explanationAnswer & explanation
Correct answer: A. Google-managed service account key
Google-managed service account keys (also known as service account keyless authentication or managed credentials) provide short-lived credentials that are automatically rotated by Google. This method eliminates the need for user-managed key files, significantly enhancing security by reducing the risk of key compromise and adhering to the 'no directly downloadable key files' policy.
Why the other options are wrong
- B. External service account keys are not a standard Google Cloud concept for internal service account authentication.
- C. SSH keys are used for secure shell access to instances, not for service accounts to authenticate to Google Cloud APIs.
- D. User-managed service account keys are JSON files that can be downloaded and do not have automatic rotation, violating the requirements.
Google-managed Service Account Key
A Google-managed service account key refers to credentials that are automatically provisioned and rotated by Google Cloud, typically used when a service account is attached to a resource like a VM.
- No physical key file is generated or downloaded by the user.
- Credentials are short-lived and automatically rotated by Google Cloud.
- Enhances security by eliminating key management overhead and reducing compromise risk.
Memory trick: Google-managed means Google handles the key and its rotation.