Google Cloud Professional Cloud Security Engineer Practice Exam

In a CI/CD workflow on Google Kubernetes Engine, what is the recommended approach for securely accessing Google Cloud APIs?

1. Create a single service account for all teams

2. Use workload identities for service account authentication

3. Run all pipelines in a shared namespace

4. Enable public access to all APIs for ease of use

The correct answer is: Use workload identities for service account authentication

Using workload identities for service account authentication is the recommended approach for securely accessing Google Cloud APIs in a CI/CD workflow on Google Kubernetes Engine. Workload Identity allows Kubernetes applications to securely access Google Cloud resources by associating Kubernetes service accounts with Google Cloud service accounts. This method enhances security because it eliminates the need to manage and distribute service account keys, which can be a vulnerability if they are exposed. Instead, it enables fine-grained access control by allowing you to specify permissions and roles directly tied to the Kubernetes service accounts, ensuring that only authorized workloads can access specific resources. This integration promotes the principle of least privilege by providing credentials only when necessary and only to the specific workloads that require access. In summary, this method not only simplifies the authentication process but also strengthens security by leveraging native Google Cloud authentication mechanisms, making it the best practice in CI/CD scenarios.