Configure Adc Service Account Impersonation Client Libraries

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your team is building automated infrastructure management scripts in Python and Go using the official Google Cloud Client Libraries. To comply with organizational security baselines, developers are strictly prohibited from downloading, exporting, or storing long-lived service account private keys (.json key files) on their local workstations.

Developers have already been granted the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role on the workload service account sa-orchestrator@company-project.iam.gserviceaccount.com.

How should developers configure their local development environments so that the client library scripts authenticate as the service account via Application Default Credentials (ADC) without using exported key files?

Generate a short-lived token with gcloud auth print-access-token and store the token string directly in a file pointed to by the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Run gcloud config set auth/impersonate_service_account sa-orchestrator@company-project.iam.gserviceaccount.com.

Run gcloud auth application-default login --impersonate-service-account=sa-orchestrator@company-project.iam.gserviceaccount.com.

Run gcloud iam service-accounts keys create key.json --iam-account=sa-orchestrator@company-project.iam.gserviceaccount.com and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to key.json.

Professional Cloud DevOps Engineer

Configure Adc Service Account Impersonation Client Libraries

Related questions