An enterprise security team wants to harden their Google Cloud environment by eliminating long-lived, user-managed service account keys. The team must enforce guardrails across the entire resource hierarchy to prevent developers from creating new service account keys or uploading external public keys. In addition, an external application running outside Google Cloud must be able to securely authenticate and access Google Cloud resources using short-lived credentials rather than static key files. Which set of actions should the security team implement?

Enforce the iam.disableServiceAccountKeyCreation and iam.disableServiceAccountKeyUpload organization policy constraints at the organization root, and configure Workload Identity Federation with the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to generate short-lived credentials for the external workload.: What the solution is This solution combines Google Cloud Organization Policy constraints with Workload Identity Federation and IAM service account impersonation to eliminate long-lived service account keys and transition external workloads to a keyless security architecture. How it meets the requirements Preventing key creation and uploads: Enforcing the iam.disableServiceAccountKeyCreation constraint blocks the generation of downloadable service account private key pairs (.json or .p12). Enforcing iam.disableServiceAccountKeyUpload prevents principals from uploading their own external public keys to Google Cloud service accounts. Applying these at the organization root ensures hierarchical inheritance across all folders and projects. Enabling keyless external workload access: Workload Identity Federation allows workloads running on external clouds or on-premises systems to exchange their native identity provider tokens (such as OIDC or SAML 2.0 assertions) for federated Google Cloud credentials. Short-lived credential generation: Granting the external identity the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on a target service account allows it to impersonate that service account and generate short-lived OAuth 2.0 access tokens directly. Key advantages Elimination of secret sprawl: Eliminates the risk of leaking static private keys in code repositories, configuration files, or build artifacts. Automated credential rotation: Short-lived access tokens expire automatically (typically within one hour), minimizing the window of vulnerability if intercepted. Centralized governance: Organization policies enforce preventative guardrails that cannot be overridden by individual project owners without explicit policy delegation. Standards-based federation: Uses industry-standard OIDC and SAML protocols to establish cryptographic trust between Google Cloud and external environments. Why this is optimal This approach directly targets the root risk of credential leakage by disabling user-managed key operations organization-wide while adopting Google Cloud's best-practice federated identity architecture for external workloads.