What's changed: Created Associate Cloud Engineer Chapter 5 (Domain 5 "Configuring access and security": IAM policies and roles = basic/predefined/custom roles, least privilege; service accounts = creation/least privilege/assigning to resources/impersonation/short-lived credentials).
5.2Service accounts
Understand service accounts—identities used by apps and workloads: creating them, using them in IAM policies with least privilege, assigning them to resources, service account impersonation, and issuing short-lived credentials to avoid long-lived keys.
A service account is an identity used by apps and workloads (not people). VMs, Cloud Run, and more use it to access other Google Cloud services. Handling service accounts safely is central to operational security.
5.2.1Using service accounts
Create a service account, grant it least-privilege roles via IAM, then assign it to a resource like a VM or Cloud Run. The assigned workload can access other services within those permissions. Importantly, a person can temporarily borrow a service account’s permissions via impersonation, running with elevated permissions only when needed rather than holding them constantly.
5.2.2Keys and short-lived credentials
You can issue long-lived keys for a service account, but keys carry leakage risk, so it is safer to avoid creating/distributing them. Instead, use short-lived credentials issued only when needed, or the automatic authentication of a service account assigned to a resource. The safe pattern: "avoid long-lived keys; assign to resources + short-lived credentials + least privilege."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.