Discuss Google Professional Cloud Developer Exam Topic 5 Question 108

You need to deploy resources from your laptop to Google Cloud using Terraform. Resources in your Google Cloud environment must be created using a service account. Your Cloud Identity has the roles/iam.serviceAccountTokenCreator Identity and Access Management (IAM) role and the necessary permissions to deploy the resources using Terraform. You want to set up your development environment to deploy the desired resources following Google-recommended best practices. What should you do?

A1) Download the service account's key file in JSON format, and store it locally on your laptop.
2) Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your downloaded key file.

B1) Run the following command from a command line: gcloud config set auth/impersonate_service_account service-account-name@project.iam.gserviceacccount.com.
2) Set the GOOGLE_OAUTH_ACCESS_TOKEN environment variable to the value that is returned by the gcloud auth print-access-token command.

C1) Run the following command from a command line: gcloud auth application-default login.
2) In the browser window that opens, authenticate using your personal credentials.

D1) Store the service account's key file in JSON format in Hashicorp Vault.
2) Integrate Terraform with Vault to retrieve the key file dynamically, and authenticate to Vault using a short-lived access token.

Suggested Answer: D

https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys#file-system

Whenever possible, avoid storing service account keys on a file system. If you can't avoid storing keys on disk, make sure to restrict access to the key file, configure file access auditing, and encrypt the underlying disk.

https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys#software-keystore

In situations where using a hardware-based key store isn't viable, use a software-based key store to manage service account keys. Similar to hardware-based options, a software-based key store lets users or applications use service account keys without revealing the private key. Software-based key store solutions can help you control key access in a fine-grained manner and can also ensure that each key access is logged.

Get Premium Professional Cloud Developer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Glynda 10 months ago

D sounds cool, but isn't it overkill for most projects?

Gladis 10 months ago

Wait, can you really use personal credentials for C? That seems risky.

Gwen 11 months ago

I think B is better for security reasons.

Jesse 11 months ago

A is definitely the standard practice here.

Kati 11 months ago

A is the way to go! Simple and effective.

Annmarie 11 months ago

I vaguely remember something about using Hashicorp Vault in option D, but I’m not confident about the integration steps with Terraform.

Wenona 11 months ago

I feel like option C is too focused on personal credentials, which doesn't align with the best practices we studied about using service accounts.

Bong 12 months ago

I think option B sounds familiar; we practiced using gcloud commands to impersonate service accounts, but I can't recall if that's the right approach for Terraform.

Venita 12 months ago

I remember we discussed the importance of using service accounts for authentication, but I'm not sure if downloading the key file is the best practice.

Gaston 1 year ago

I like the idea of using Vault in option D. That would provide a more secure way to manage the service account credentials. But you're right, it might be a bit complex for this particular exam question. I'll keep that in mind for future scenarios where security is a bigger concern.

Yvonne 1 year ago

Option C is interesting, but I'm not sure if using my personal credentials is the best practice here. Shouldn't we be using the service account to authenticate instead? I'll have to double-check the requirements on that.

Ligia 1 year ago

Hmm, I'm a bit confused. Option B talks about impersonating the service account, which I'm not sure I fully understand. And option D with Vault seems a bit overkill for this scenario. I'll need to read through the details more carefully.

Bulah 1 year ago

This question seems straightforward. I think option A is the way to go - downloading the service account key file and setting the environment variable. Seems like the simplest and most direct approach.

Bette 1 year ago

I'm not sure, but option C seems like a good option too. It involves authentication using personal credentials.

Pansy 1 year ago

I disagree, I believe option D is better. It adds an extra layer of security with Hashicorp Vault.

Tenesha 1 year ago

Downloading a key file? What is this, the Dark Ages? Let's use the cloud, people!

Chandra 1 year ago

I think option A is the best choice. It's simple and straightforward.

Graciela 1 year ago

Now we're talking! Storing the key in a secure vault and using a short-lived token, that's the way to go. Google would approve of that.

Dustin 1 year ago

↳ replying to Graciela

D) Store the service account's key file in JSON format in Hashicorp Vault.

Judy 1 year ago

↳ replying to Graciela

A) Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your downloaded key file.

Winfred 1 year ago

↳ replying to Graciela

A) Download the service account's key file in JSON format, and store it locally on your laptop.

Cordelia 1 year ago

Authenticating with my personal credentials? That doesn't sound right, this is supposed to be a service account deployment.

Ivan 1 year ago

↳ replying to Cordelia

D) Store the service account's key file in JSON format in Hashicorp Vault. Integrate Terraform with Vault to retrieve the key file dynamically, and authenticate to Vault using a short-lived access token.

Huey 1 year ago

↳ replying to Cordelia

C) Run the following command from a command line: gcloud auth application-default login. In the browser window that opens, authenticate using your personal credentials.

Jolanda 1 year ago

↳ replying to Cordelia

A) Download the service account's key file in JSON format, and store it locally on your laptop. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your downloaded key file.

Rima 1 year ago

↳ replying to Cordelia

B) Run the following command from a command line: gcloud config set auth/impersonate_service_account service-account-name@project.iam.gserviceacccount.com.

Ashlyn 1 year ago

↳ replying to Cordelia

A) Download the service account's key file in JSON format, and store it locally on your laptop.

Zena 1 year ago

Impersonating the service account using gcloud? That's an interesting approach, but I wonder if it's really the recommended best practice.

Basilia 1 year ago

Option A looks straightforward, but downloading the service account key file locally doesn't seem very secure. Hmm, maybe there's a better way.

Willard 1 year ago

↳ replying to Basilia

Paris 1 year ago

↳ replying to Basilia

C) Run the following command from a command line: gcloud auth application-default login. In the browser window that opens, authenticate using your personal credentials.

Edna 1 year ago

↳ replying to Basilia

A) Download the service account's key file in JSON format, and store it locally on your laptop. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your downloaded key file.

Google Professional Cloud Developer Exam - Topic 5 Question 108 Discussion