A security team is reviewing a Python administrative automation service running on a Compute Engine instance. The service programmatically manages Cloud Storage resources across multiple production Google Cloud projects. Currently, the service authenticates using static JSON service account keys stored on the local instance disk, violating enterprise compliance policies. The architecture team needs a solution that eliminates long-lived credentials while enabling secure programmatic interaction across project boundaries. Which approach should be implemented to meet these requirements?
- Authenticate using Application Default Credentials (ADC) associated with the VM's attached service account, and use short-lived service account impersonation to interact with target projects.Answer
- BEmbed the service account JSON keys directly into environment variables within the application source code repository.
- CAssign the primitive Owner IAM role to the VM instance service account at the Google Cloud organization level.
- DStore the JSON service account key files on an unversioned local disk partition attached to the instance.
Answer
The application should authenticate using Application Default Credentials (ADC) provided by the compute platform's metadata server and utilize service account impersonation with short-lived tokens for cross-project access.
Utilizing Application Default Credentials (ADC) allows Google Cloud SDKs to dynamically retrieve short-lived OAuth 2.0 access tokens from the Compute Engine metadata server. When combined with service account impersonation (`roles/iam.serviceAccountTokenCreator`), the application can securely generate short-lived tokens to access resources across project boundaries without creating or storing long-lived service account JSON key files.
Step-by-Step Solution
Key Concept
Programmatic Authentication via Application Default Credentials (ADC) and Service Account Impersonation