Associate Cloud Engineer free question 2 / 10 · Domain 1: Setting up a cloud solution environment
You created a workforce pool for employees of a partner company. You do not want users in the pool to access resources outside your own organization. Which statement correctly describes a point the Workforce Identity Federation documentation cautions about?
- If you attach an allow policy on a resource in another organization, pool users can access it directly
- If you allow impersonation of a service account in the organization, pool users can reach beyond the organization
- Another organization that knows the pool ID can grant roles to pool users
- Unless the workforce pool is placed in a VPC Service Controls perimeter, users can reach beyond the organization
Show the answer and explanation
Answer: B
Why this is correct
The documentation says principals in a workforce pool cannot directly access resources outside the organization they belong to. However, if you give them permission to impersonate a service account in the organization, they can get around this restriction, because service accounts do not have the same restriction. If the goal is to keep them from leaving the organization, you need to check which service accounts the pool users are allowed to impersonate.
Why the other options are wrong
"If you attach an allow policy on a resource in another organization, pool users can access it directly" … The documentation says principals in a workforce pool cannot directly access resources outside the organization they belong to. Even if you grant an allow policy on a resource in another organization, you cannot give them direct access.
"Another organization that knows the pool ID can grant roles to pool users" … What the documentation describes is reference within the organization: with the right permissions, the pool can be referenced by its ID from all projects and folders in the organization. Pool principals cannot directly access resources outside the organization, so another organization cannot grant roles and have them used.
"Unless the workforce pool is placed in a VPC Service Controls perimeter, users can reach beyond the organization" … The documentation says a workforce pool is an organization-level resource, and that VPC Service Controls does not support directly adding organization-level resources to a perimeter. To reach the Workforce STS API from inside a perimeter, you configure egress rules.
Key point
If the goal is to keep users from leaving the organization, you need to check which service accounts the pool users are allowed to impersonate. You can create multiple pools and separate them, for example one for employees and one for partners. The pool ID must be globally unique across all workforce pools in Google Cloud.
Go to the Associate Cloud Engineer practice app (10 free questions; purchase unlocks all questions)