Workload identity federation in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Workload Identity Pool in Google Cloud.

GCP

gcloud iam workload-identity-pools create [1] --location="global" --display-name="My Pool"

Drag options to blanks, or click blank then click option'

Amy-pool-123

Bmy-project

Cmy-service-account

Dmy-bucket

Attempts:

3 left

💡 Hint

Common Mistakes

Using the project ID instead of the pool name.

Using a service account name where a pool name is required.

The command requires the name of the Workload Identity Pool to create. "my-pool-123" is a valid pool name.

2fill in blank

medium

Complete the code to create a Workload Identity Provider inside the pool.

GCP

gcloud iam workload-identity-pools providers create-oidc [1] --workload-identity-pool="my-pool-123" --issuer-uri="https://accounts.google.com" --location="global" --display-name="Google OIDC Provider"

Drag options to blanks, or click blank then click option'

Aoidc-provider

Bmy-pool-123

Cgoogle-provider

Dmy-service-account

Attempts:

3 left

💡 Hint

Common Mistakes

Using the pool name instead of the provider name.

Using a service account name instead of a provider name.

The provider name must be specified when creating a Workload Identity Provider. "google-provider" is a valid name.

3fill in blank

hard

Fix the error in the command to bind a service account to the workload identity pool provider.

GCP

gcloud iam service-accounts add-iam-policy-binding [e-mail] --role="roles/iam.workloadIdentityUser" --member="principalSet://iam.googleapis.com/projects/[1]/locations/global/workloadIdentityPools/my-pool-123/attribute.repository/my-repo"

Drag options to blanks, or click blank then click option'

Amy-project

Bmy-service-account

Cmy-pool-123

Dglobal

Attempts:

3 left

💡 Hint

Common Mistakes

Using the service account name instead of the project ID.

Using the pool name in place of the project ID.

The project number or ID must be used in the member string to correctly identify the project context.

4fill in blank

hard

Fill both blanks to configure the attribute mapping for the workload identity provider.

GCP

gcloud iam workload-identity-pools providers update-oidc google-provider --workload-identity-pool=my-pool-123 --location=global --attribute-mapping="google.subject=[1],attribute.repository=[2]"

Drag options to blanks, or click blank then click option'

Aassertion.sub

Bassertion.repository

Cassertion.aud

Dassertion.iss

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'aud' or 'iss' claims incorrectly in place of 'sub' or 'repository'.

Mixing up the attribute mapping keys and values.

The attribute mapping uses OIDC token claims. "assertion.sub" maps to google.subject and "assertion.repository" maps to attribute.repository.

5fill in blank

hard

Fill all three blanks to create a service account key and configure the environment variable for authentication.

GCP

gcloud iam service-accounts keys create [1] --iam-account=[2]@my-project.iam.gserviceaccount.com
export GOOGLE_APPLICATION_CREDENTIALS=[3]

Drag options to blanks, or click blank then click option'

Akey.json

Bmy-service-account

C/home/user/key.json

D/tmp/keyfile.json

Attempts:

3 left

💡 Hint

Common Mistakes

Using mismatched file names between key creation and environment variable.

Using incorrect service account names.

The key file is created as 'key.json', the service account is 'my-service-account', and the environment variable points to the key file path '/home/user/key.json'.