An organization runs an automated Python script on a third-party continuous integration (CI) platform outside Google Cloud. The script programmatically uploads build artifacts to Cloud Storage and writes log entries to Cloud Logging. To adhere to Google Cloud security and operational best practices for programmatic interactions from external environments, which TWO actions should the engineering team perform?
- Configure Workload Identity Federation between the external CI provider and Google Cloud to allow short-lived credential exchange.Cevap
- BDownload a persistent service account JSON key file and store it as an environment variable in the CI runner.
- Initialize Google Cloud Client Libraries using Application Default Credentials (ADC) to automatically detect credentials from the runtime environment.Cevap
- DGrant the primitive Owner role (roles/owner) to the service account to prevent API credential permission errors during runtime.
Cevap
The team should configure Workload Identity Federation for keyless authentication from the external CI environment and initialize Google Cloud Client Libraries using Application Default Credentials (ADC) to automatically load short-lived tokens.
Workload Identity Federation allows external workloads (such as third-party CI runners) to securely exchange external OIDC tokens for short-lived Google Cloud service account credentials without managing long-lived JSON keys. Initializing SDK client libraries with Application Default Credentials (ADC) enables application code to seamlessly pick up credentials from standard environment configurations.
Adım Adım Çözüm
Anahtar Kavram
Keyless programmatic authentication using Workload Identity Federation and Application Default Credentials (ADC)