Iam Service Account Credentials Token Types

What each credential type is and does

Each short-lived credential format generated by the IAM Service Account Credentials API (iamcredentials.googleapis.com) is tailored for specific authentication, authorization, and cryptographic use cases across Google Cloud.

How this configuration meets the requirements

• Cloud Run authentication: Services hosted on serverless platforms such as Cloud Run or Cloud Run functions, as well as endpoints secured by Identity-Aware Proxy (IAP), require Google-signed OpenID Connect (OIDC) ID tokens. Calling the generateIdToken method generates a signed JSON Web Token (JWT) containing an aud (audience) claim matching the target service URL.
• External Cloud Storage upload: Creating a Cloud Storage signed URL requires creating a cryptographic signature over canonical HTTP request elements (such as HTTP verb, MD5, expiration, and resource path). The signBlob method uses the service account's Google-managed private key held in escrow to sign the arbitrary payload without exporting or exposing the private key.
• Standard Google Cloud REST APIs: Google Cloud resource management and infrastructure APIs accept OAuth 2.0 access tokens as bearer tokens in the HTTP Authorization: Bearer header. Calling generateAccessToken creates a temporary, short-lived OAuth 2.0 access token restricted by requested OAuth scopes.

Key advantages of this approach

• Elimination of long-lived service account keys: All tokens and signatures are generated on-demand via IAM delegation and service account impersonation.
• Audience restriction: The OIDC ID token is restricted to the specific target service via its aud claim, preventing replay attacks against other services.
• Least privilege: Cryptographic signing via signBlob delegates time-bounded bucket access to external parties without granting them IAM roles or service account credentials.