An application running on a Google Compute Engine virtual machine requires read access to an Google Cloud Storage bucket. To adhere to security best practices for service account lifecycle management, the security team prohibits downloading long-lived service account key files. Which approach should you use to securely authenticate the application to Cloud Storage?
- Attach a service account with the required Cloud Storage permissions directly to the Compute Engine instance and authenticate using Application Default Credentials (ADC).Answer
- BCreate a service account key file in JSON format, download it to the VM, and reference its local file path in the application code.
- CGrant the primitive Owner role to the default Compute Engine service account to eliminate identity configuration requirements.
- DAssign the Service Account Admin role to the VM's service account so it can dynamically generate new service account keys at runtime.
Answer
Attaching a service account directly to the Compute Engine instance and using Application Default Credentials (ADC) is the Google-recommended keyless authentication method.
Attaching a custom service account to a Compute Engine instance enables keyless authentication through the metadata server. Application Default Credentials (ADC) automatically fetch short-lived access tokens, ensuring robust service account lifecycle security without long-lived exported keys.
Step-by-Step Solution
Key Concept
Keyless Authentication via Attached Service Accounts and Application Default Credentials