You are designing a new Google Cloud organization for a client. Your client is concerned with the risks associated with long-lived credentials created in Google Cloud. You need to design a solution…

Question

Options

• AApply the constraints/iam.disableServiceAccountKevCreation constraint to the organization.
• BUse custom versions of predefined roles to exclude all iam.serviceAccountKeys.* service account
• CApply the constraints/iam.disableServiceAccountKeyUpload constraint to the organization.
• DGrant the roles/iam.serviceAccountKeyAdmin IAM role to organization administrators only.

• A
  78% (31)
• B
  8% (3)
• C
  3% (1)
• D
  13% (5)

Explanation

The Organization Policy constraint constraints/iam.disableServiceAccountKeyCreation, applied at the organization level, completely blocks the creation of any new JSON service account keys across all projects in the organization. This is a one-step, policy-based control that requires no ongoing manual oversight and eliminates the risk at the source. Option B (custom roles excluding key-related permissions) is complex to maintain and does not prevent a project owner or administrator from still creating keys through other means. Option C (disableServiceAccountKeyUpload) only prevents uploading externally created keys but does not prevent creating new keys within Google Cloud. Option D (restricting the key admin role) limits who can manage keys but does not eliminate their creation-it still leaves the risk in place.

No community discussion yet for this question.