You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of…

Question

Options

• A
  1. Create a general service account "g-sa" to orchestrate the batch jobs.
• B
  1. Create a general service account "g-sa" to execute the batch jobs.
• C
  1. Create a workload identity pool and configure workload identity pool providers for each batch
• D
  1. Create a general service account "g-sa" to orchestrate the batch jobs.

• A
  7% (2)
• C
  10% (3)
• D
  83% (24)

Explanation

This approach adheres to the principle of least privilege by ensuring that each batch job has only the permissions it needs to run. The general service account “g-sa” is used to orchestrate the batch jobs, and the Service Account Token Creator role allows it to obtain short-lived access tokens for the batch job service accounts “b-sa-[1-5]”. This setup allows the batch jobs to be executed with the permissions of the respective service accounts.

No community discussion yet for this question.