A software development team is building an automated CI/CD pipeline task in Cloud Build using the Python Google API Client Library to configure Cloud Logging export sinks across multiple Google Cloud projects. Security policy strictly prohibits storing long-lived service account private keys in source code or storage buckets. To comply with security policies while ensuring seamless API access, how should the team configure authentication for the Python script?
- Configure the script to rely on Application Default Credentials (ADC) using the attached Cloud Build service account, which has been granted fine-grained IAM roles on the target projects.Cevap
- BGenerate a service account JSON key file, embed it into the application source repository, and initialize the SDK client directly using from_service_account_json().
- CAssign the primitive Owner IAM role to the Cloud Build default service account at the organization level to bypass individual project permission checks.
- DStore a static service account key file in an unversioned Cloud Storage bucket and programmatically download it to local memory before initiating SDK API calls.
Cevap
Configure the script to rely on Application Default Credentials (ADC) using the attached service account with fine-grained IAM roles on target projects.
The Google Cloud SDK automatically discovers identity credentials via Application Default Credentials (ADC) when running inside GCP environments such as Cloud Build. By attaching a service account to the build job and assigning fine-grained IAM roles on target projects, the Python script authenticates seamlessly without using static key files or broad primitive permissions.
Adım Adım Çözüm
Anahtar Kavram
Application Default Credentials (ADC) and programmatic GCP authentication best practices.