Configure Iam Least Privilege Service Account Impersonation

What Service Account Impersonation and Scoped Predefined Roles Are

Service account impersonation is an IAM security pattern that allows an authenticated principal (such as a CI/CD runner service account) to temporarily generate short-lived OAuth 2.0 credentials and act on behalf of a target service account. Coupled with fine-grained predefined IAM roles, this approach enforces least privilege at specific resource hierarchy levels rather than across entire projects.

How It Meets the Requirements

• Eliminating Long-Lived Credentials: By granting roles/iam.serviceAccountTokenCreator directly on the target service account, the CI/CD pipeline acquires ephemeral access tokens at runtime via the IAM Credentials API, completely eliminating the need for downloadable JSON service account keys.
• Least-Privilege BigQuery and Storage Access: Granting roles/storage.objectViewer specifically on the target Cloud Storage bucket and roles/bigquery.dataEditor on the specific BigQuery dataset restricts data access to only the necessary resources. The roles/bigquery.jobUser role granted at the project level provides the minimal permission required to execute query and load jobs without granting broad administrative privileges.

Key Advantages

• Zero Secret Management Overhead: Eliminates the risk of key leaks, credential rotation drift, and stale credentials.
• Resource-Level Isolation: Protects unrelated buckets and datasets in project-analytics-prod from unauthorized reads and writes.
• Separation of Duties: Decouples CI/CD deployment execution from workload data access permissions.