An application deployed on a Compute Engine virtual machine (VM) needs to read objects from a Cloud Storage bucket programmatically using the Google Cloud SDK. Which approach is the most secure and recommended method to handle authentication for this application?
- Attach a custom service account with specific Cloud Storage roles to the VM and authenticate using Application Default Credentials (ADC).Cevap
- BCreate a service account JSON key file and hardcode the credentials directly into the application source code repository.
- CAssign the Owner primitive IAM role to the default Compute Engine service account to ensure the application has all necessary permissions.
- DDownload a service account key file to unversioned local disk storage on the VM and read the file path during application initialization.
Cevap
Attach a custom service account with specific Cloud Storage roles to the VM and authenticate using Application Default Credentials (ADC).
Attaching a custom service account to a Compute Engine VM enables the Google Cloud SDK and client libraries to automatically retrieve short-lived OAuth 2.0 access tokens from the instance metadata server via Application Default Credentials (ADC). This eliminates the management and security risks associated with storing or rotating long-lived service account key files.
Adım Adım Çözüm
Anahtar Kavram
Application Default Credentials (ADC) and Service Account Attachments