Your organization is using GitHub Actions as a continuous integration and delivery (CI/CD) platform. You must enable access to Google Cloud resources from the CI/CD pipelines in the most secure way…

Question

Options

• ACreate a service account key, and add it to the GitHub pipeline configuration file.
• BCreate a service account key, and add it to the GitHub repository content.
• CConfigure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials
• DConfigure workload identity federation to use GitHub as an identity pool provider.

• A
  2% (1)
• B
  9% (4)
• C
  16% (7)
• D
  73% (32)

Explanation

Workload Identity Federation (D) is the most secure method because it allows GitHub Actions workflows to authenticate to Google Cloud using short-lived, automatically rotated OIDC tokens issued by GitHub - no long-lived service account key is ever created or stored. You configure a Workload Identity Pool with GitHub Actions as the OIDC provider, then bind a service account to specific GitHub repository/workflow conditions. Options A and B both involve service account keys, which are long-lived static credentials that represent a significant security risk if leaked through repository content, logs, or CI/CD configuration. Option C (GKE Workload Identity) is a valid pattern but requires running a GKE cluster solely to issue credentials to GitHub Actions, which adds unnecessary infrastructure complexity and cost compared to the direct federation approach in D.

No community discussion yet for this question.