An organization requires developers to run local test scripts against Google Cloud APIs using short-lived credentials instead of static JSON key files. A security policy dictates that developers must authenticate as a target service account via service account impersonation using Application Default Credentials (ADC). In what sequence should a platform engineer configure the local environment and code execution pipeline to achieve this?
- 1Authenticate the developer's individual user account to the Google Cloud CLI using gcloud auth login.
- 2Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the developer's user identity on the target service account.
- 3Execute gcloud auth application-default login --impersonate-service-account to configure Application Default Credentials for local SDK calls.
- 4Execute application code that initializes Google Cloud Client Libraries using default authentication without hardcoded credentials.
Answer
The correct order establishes authentication first, grants token creation permissions second, configures local Application Default Credentials with impersonation flags third, and executes application code using standard SDK auto-discovery fourth.
Configuring secure SDK programmatic interaction requires authenticating the user identity first, ensuring the identity has the Service Account Token Creator role on the target service account second, configuring local ADC with the --impersonate-service-account flag third, and finally executing the application code using native client library auto-discovery fourth.
Step-by-Step Solution
Key Concept
Service Account Impersonation via Application Default Credentials (ADC)