An engineer needs temporary elevated access without holding a key. What fits?
Why C is the answer
Service account impersonation
Service account impersonation gives temporary elevated access with no key to hold.
In detail
- Impersonation gives temporary access with no key.
- Access is logged.
Use case
An illustrative scenario, not a real incident.
An engineer impersonates a service account for an hour, and no key ever exists.
See it in different ways
mindmap
root((Security))
Identity
Workload Identity Federation
Impersonation
Separation of duties
Data
Customer-managed keys
VPC Service Controls
Policy
Organization level
AI
Model ArmorsequenceDiagram participant P0 as Engineer participant P1 as Service account participant P2 as Resource P0->>P1: Impersonate P1->>P2: Short-lived access
Key point: Impersonation avoids keys.
Why the other options are wrong
- A. A shared password
- A shared password is unsafe.
- B. A permanent Owner role
- A permanent role is the opposite.
- D. A downloaded service account key
- A downloaded key is long-lived.