What's changed: Created Professional Cloud Security Engineer Chapter 1 (Domain 1 "Configuring access": Cloud Identity/GCDS/SSO(SAML/OAuth)/super admin/user lifecycle/Workforce Identity Federation; service accounts/default SA/key auditing/Workload Identity Federation/short-lived credentials/impersonation/2SV; IAM predefined-custom/separation of duties/IAM conditions/IAM deny policies/groups/Access Context Manager/Policy Intelligence/Privileged Access Manager; resource hierarchy/folders/projects/organization policies (pre-built-custom)/inheritance).
1.1Cloud Identity, service accounts, and authentication
Understand Cloud Identity management (Google Cloud Directory Sync, SSO with third-party IdPs, super admin, user-lifecycle automation, Workforce Identity Federation), securing service accounts (default SAs, key auditing/mitigation, short-lived credentials, Workload Identity Federation, impersonation), and authentication (password/session policy, SAML/OAuth, 2-step verification).
A Professional Cloud Security Engineer designs, implements, and operates secure Google Cloud. The first pillar is identity: who represents workloads and people, and how they authenticate. Avoid key leakage and master federation and short-lived credentials.
1.1.1Cloud Identity and human authentication
Manage human identities with Cloud Identity. Sync on-prem AD users/groups via Google Cloud Directory Sync (GCDS) and delegate authentication with SSO (SAML/OAuth) to a third-party IdP. Tightly protect the most powerful super administrator account (fewest people, 2SV, break-glass) and automate user-lifecycle create/disable. To use external IdP human identities directly in Google Cloud without creating accounts, use Workforce Identity Federation. Raise authentication strength with 2-step verification (2SV) and password/session management policy. Map "federate external-IdP people = Workforce Identity Federation" and "most powerful = tightly protect super admin."
1.1.2Service accounts and workload authentication
Represent workload identity with service accounts. Default service accounts tend to be over-privileged—disable/minimize them, and create/disable/authorize dedicated SAs only where needed. The biggest risk is leaked service account keys, so avoid creating keys; from external/on-prem/CI/CD use Workload Identity Federation for keyless federation, and obtain temporary privileges via short-lived credentials and service account impersonation. If keys are unavoidable, limit damage with auditing, rotation, and disabling. Map "no keys = Workload Identity Federation/impersonation" and "temporary privilege = short-lived credentials."
Common: requirement → means. E.g., "sync on-prem AD to Google" = GCDS; "use external-IdP people without creating accounts" = Workforce Identity Federation; "authenticate external/CI/CD workloads keyless" = Workload Identity Federation; "run temporarily with another SA's privileges" = impersonation/short-lived credentials; "tightly protect the most powerful role" = minimize super admins + 2SV.
Watch the mix-ups: (1) Do not confuse Workforce Identity Federation (people/external IdP) with Workload Identity Federation (workloads/external systems). (2) Downloading service-account keys is a last resort—a leak source. (3) Default SAs tend to be over-privileged—disable/minimize them.
1.1.3Section summary
- People = Cloud Identity/GCDS/SSO; external-IdP people = Workforce Identity Federation; tightly protect super admin
- Workloads = service accounts; avoid keys via Workload Identity Federation/impersonation/short-lived credentials
- Auth strength = 2SV + password/session policy; SSO via SAML/OAuth
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To let human users managed in an external IdP access Google Cloud resources without creating Google accounts, which is best?
Q2. To authenticate on-prem/external workloads to Google Cloud without service-account keys, which is best?
Q3. A CI/CD job must temporarily run with a specific service account's privileges. Without creating keys, which is best?
Q4. To sync on-prem Active Directory users and groups into Cloud Identity, which tool?
Q5. Which is the best practice to reduce risk of the most-powerful super administrator account?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.