Associate Cloud Engineer free question 10 / 10 · Domain 4: Configuring access and security
You have three environments on AWS: development, staging, and production. Workloads in each need to access Google Cloud resources. According to the Workload Identity Federation overview, how does it recommend creating workload identity pools?
- Use one pool and tell the environments apart with separate pool providers
- Create a new pool for each of the three environments outside Google Cloud
- Use one pool and tell the environments apart by where service account keys are issued
- Split Google Cloud organizations per environment and place one pool in each organization
Show the answer and explanation
Answer: B
Why this is correct
A workload identity pool is for managing external identities. The page generally recommends creating a new pool for each non-Google Cloud environment that needs to access Google Cloud resources, such as development, staging, or production. A pool provider represents the relationship between Google Cloud and an identity provider (AWS, Microsoft Entra ID, GitHub, GitLab, a Kubernetes cluster, Okta, AD FS, Terraform, and others).
Why the other options are wrong
"Use one pool and tell the environments apart with separate pool providers" … A provider represents the relationship between Google Cloud and an identity provider such as AWS. What the page recommends separating per environment is the pool.
"Use one pool and tell the environments apart by where service account keys are issued" … Workload Identity Federation exists to remove the burden of managing and securing service account keys. A design that separates environments by key is against that purpose.
"Split Google Cloud organizations per environment and place one pool in each organization" … What the page recommends is creating a pool for each environment outside Google Cloud, not splitting organizations.
How it works
Workload Identity Federation follows the OAuth 2.0 token exchange specification. You pass the identity provider credentials to the Security Token Service, which verifies the identity of the credentials and returns a federated token in exchange. It lets on-premises and multi-cloud workloads access Google Cloud resources without service account keys.
Go to the Associate Cloud Engineer practice app (10 free questions; purchase unlocks all questions)