Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Adc Workload Identity Multi Environment Authentication

Section: Accessing Google API best practices

An enterprise development team is building a microservices application that interacts programmatically with Google Cloud APIs, including BigQuery and Cloud Storage. The application codebase is deployed across multiple environments: developer workstations for local testing, Compute Engine instances for staging, and Google Kubernetes Engine (GKE) clusters for production.

The security architecture requires eliminating the risks associated with downloadable, long-lived service account keys and ensuring least privilege access across each deployment tier without code changes.

Which identity and authentication strategy should the team implement?

Embed OAuth 2.0 refresh tokens directly inside application container images and deploy an internal token-vending proxy to exchange them for long-lived access tokens.

Grant service agent roles directly to user accounts and compute instances, and enable default project-wide API access scopes across all environments.

Configure the application to use Application Default Credentials (ADC) via official client libraries, using user credentials via gcloud auth application-default login locally, attached IAM service accounts on Compute Engine, and Workload Identity on GKE.

Create a centralized IAM service account, generate a downloadable JSON key file, and configure the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to the file across all environments.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Adc Workload Identity Multi Environment Authentication

Section: Accessing Google API best practices

Which identity and authentication strategy should the team implement?

Embed OAuth 2.0 refresh tokens directly inside application container images and deploy an internal token-vending proxy to exchange them for long-lived access tokens.

Grant service agent roles directly to user accounts and compute instances, and enable default project-wide API access scopes across all environments.

Create a centralized IAM service account, generate a downloadable JSON key file, and configure the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to the file across all environments.

Explanations

What Application Default Credentials (ADC) and Runtime Identities Are

Application Default Credentials (ADC) is a flexible authentication mechanism provided by Google Cloud client libraries that automatically detects credentials based on the application's runtime environment. Instead of requiring hardcoded paths or static tokens, ADC searches a predefined order of locations—such as local user configuration, environment variables, or platform metadata services—to seamlessly acquire short-lived OAuth 2.0 access tokens.

How it Meets the Stated Requirements

No Long-Lived Service Account Keys: Eliminates the need to create, download, or rotate JSON service account private keys. Tokens are generated dynamically and are short-lived.
Automated Discovery Across Environments: The application code calls standard client library constructors (StorageClient(), BigQueryClient()), which transparently invoke ADC across developer machines, VMs, and Kubernetes pods.
Least Privilege and Environment Separation: Developers authenticate using their individual Google accounts via gcloud auth application-default login with bounded developer roles, Compute Engine VMs use attached service accounts via the instance metadata server, and GKE workloads leverage Workload Identity to bind Kubernetes Service Accounts (KSAs) to specific Google Service Accounts (GSAs).

Key Advantages and Capabilities

Unified Codebase: The application code remains identical across development, staging, and production environments.
Reduced Blast Radius: Short-lived tokens minimize the window of opportunity if credentials are intercepted.
Granular IAM Scoping: Enables distinct IAM roles for each individual microservice rather than sharing overly broad project-level credentials.
Seamless Key Rotation: Cryptographic key rotation is completely managed under the hood by Google Cloud infrastructure.

Why This Is Optimal

ADC combined with platform-native identity binding (Compute Engine metadata service and GKE Workload Identity) adheres directly to Google Cloud security best practices. It avoids secret leakage vectors associated with static files while automating credential discovery and token refresh lifecycles without developer intervention.

View source documentation

Professional Cloud Architect

Adc Workload Identity Multi Environment Authentication

Professional Cloud Architect

Adc Workload Identity Multi Environment Authentication

What Application Default Credentials (ADC) and Runtime Identities Are

How it Meets the Stated Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions