service account impersonation

Related topics

• direct resource access is an alternative to service account impersonation From the official documentation: “Before you set up a WIP and provider, you need to choose how the workload is going to access your resources: direct resource access, or service account impersonation.”
• service account impersonation is an alternative to service account key From the official documentation: “If you cannot use a user account or service account impersonation for local development, you can use a service account key.”
• Application Default Credentials works with service account impersonation From the official documentation: “You can use service account impersonation to set up a local Application Default Credentials (ADC) file.”
• service account impersonation configures Application Default Credentials From the official documentation: “You can use service account impersonation to set up a local ADC file.”
• service account impersonation depends on Security Token Service From the official documentation: “To create a service account for the external workload, do the following: 1. Enable the IAM, Security Token Service, and Service Account Credentials APIs, if any are not already enabled.”
• service account impersonation depends on Service Account Credentials API From the official documentation: “To impersonate a service account, you need to enable the Service Account Credentials API in your project.”
• service account impersonation depends on Service Account Token Creator From the official documentation: “You must have the Service Account Token Creator (`roles/iam.serviceAccountTokenCreator`) IAM role on the service account you are impersonating.”
• credential configuration file configures service account impersonation From the official documentation: “Use a [credential configuration file](https://google.aip.dev/auth/4117) to configure an external application to impersonate a service account.”
• service account impersonation depends on IAM Service Account Credentials API From the official documentation: “If you use service account impersonation, use the token from the Security Token Service to invoke the [`generateAccessToken` method](/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken) of the [IAM Service Account Credentials…”
• service account impersonation depends on service account From the official documentation: “Service account impersonation should always involve two principals: a principal that represents the caller, and the service account that is being impersonated, called the privilege-bearing service account.”
• service account impersonation is an alternative to service account keys From the official documentation: “If you use impersonation, instead of creating service account keys that anyone can use to access your deployment, you manage access by granting or revoking the [Service Account Token Creator (`roles/iam.serviceAccountTokenCreator`) IAM…”
• Service Account Token Creator configures service account impersonation From the official documentation: “Paste the unique email address into the **New principals** field and assign the **Service Account Token Creator** role (`roles/iam.serviceAccountTokenCreator`).”
• Workload Identity Federation depends on service account impersonation From the official documentation: “Workload Identity is the recommended and more secure approach because it uses short-lived, temporary access tokens using service account impersonation, minimizing long-lived secret credential exposure risks.”
• Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
• Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
• Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
• Cloud Run depends on service account From the official documentation: “The Cloud Run function needs a service account with permissions to write to GCS bucket and be invoked by Pub/Sub.”
• Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
• Cloud Run works with Pub/Sub From the official documentation: “Route Cloud Pub/Sub events to Cloud Run”
• Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
• Cloud Run depends on Pub/Sub From the official documentation: “Create a Pub/Sub topic that Cloud Scheduler will publish to and the Cloud Run function will subscribe to.”
• service account key is an alternative to Workload Identity Federation From the official documentation: “For hosts outside of Google Cloud, you can provide a service account key or configure Workload Identity Federation (WIF).”
• service account keys is an alternative to Workload Identity Federation From the official documentation: “Where possible, consider using Workload Identity Federation instead of service account keys.”
• Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• service account key is an alternative to Workload Identity Federation for GKE From the official documentation: “Enabling it lets you use IAM policies to grant Kubernetes workloads in your GKE cluster access to specific Google Cloud APIs without needing manual configuration or less secure methods like service account key files.”
• Cloud Storage works with Identity and Access Management From the official documentation: “To learn how to use IAM with Cloud Storage, see [Using IAM Permissions](/storage/docs/access-control/using-iam-permissions).”
• Cloud Storage works with Pub/Sub From the official documentation: “| **Google Cloud** | Cloud Storage | Pub/Sub |”
• Cloud Storage is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
• Identity and Access Management works with Workload Identity Federation for GKE From the official documentation: “Instead, your GKE cluster directly authenticates workloads using Google Cloud IAM.”
• Application Default Credentials works with Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• Application Default Credentials works with Identity and Access Management From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
• Identity and Access Management secures Cloud Storage From the official documentation: “Cloud Storage uses Identity and Access Management (IAM) for authorization.”
• service account is part of Identity and Access Management From the official documentation: “Service accounts function as both principals and resources within IAM.”
• service account key is part of service account From the official documentation: “A service account can have up to 10 keys.”
• gcloud CLI works with Workload Identity Federation From the official documentation: “Support for Workload Identity Federation in gcloud CLI is available in [version 363.0.0 and later versions of the gcloud CLI](/sdk/docs/components#updating_components).”
• Application Default Credentials works with Workload Identity Federation From the official documentation: “ADC also supports [Workload Identity Federation](#workload-identity-federation), enabling applications to access Google Cloud resources from external platforms like Amazon Web Services (AWS), Microsoft Azure, or any identity provider that supports OpenID Connect (OIDC).”
• Cloud Run works with Identity and Access Management From the official documentation: “Cloud Run also offers the ability to control access to a service with Identity and Access Management (IAM).”
• Cloud Storage works with service account From the official documentation: “The service account can manage objects in the Cloud Storage bucket.”
• credential configuration file is an alternative to service account key From the official documentation: “This approach uses the credential configuration files in place of the Google service account key files.”
• gcloud CLI configures Application Default Credentials From the official documentation: “**gcloud CLI**: Manage cloud resources, configure projects, and set up local Application Default Credentials (ADC).”
• Identity and Access Management depends on Application Default Credentials From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
• Identity and Access Management secures Pub/Sub From the official documentation: “Pub/Sub uses Identity and Access Management (IAM) for authorization.”
• Pub/Sub works with service account From the official documentation: “5. Creates a service account to represent the Pub/Sub subscription identity.”
• Security Token Service works with Workload Identity Federation From the official documentation: “By using Workload Identity Federation, workloads that run on AWS EC2 and Azure VMs can exchange their environment-specific credentials for short-lived Google Cloud Security Token Service tokens.”
• service account keys is part of service account From the official documentation: “You use the Identity and Access Management API to create a new key pair for a service account.”
• Workload Identity Federation depends on Security Token Service From the official documentation: “You provide a credential from your identity provider (IdP) to the [Security Token Service](/iam/docs/reference/sts/rest), which verifies the identity on the credential, and then returns a [federated access token](/docs/authentication/token-types#fed-access-tokens) in exchange.”
• Application Default Credentials configures Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
• Application Default Credentials configures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see [Set up authentication for client libraries](/storage/docs/authentication#client-libs).”
• Application Default Credentials works with Security Token Service From the official documentation: “The ADC authentication library uses the data in the ConfigMap to exchange the ServiceAccount JWT that you mounted on the Pod for a short-lived [federated access token](/docs/authentication/token-types#fed-access-tokens) from [Security Token…”
• Application Default Credentials depends on service account From the official documentation: “If your `BidiProcessOrder` client runs in a secure environment that can be configured with service account credentials (such as Compute Engine, Google Kubernetes Engine, or your on-premise servers), it can use [Application Default Credentials…”
• Application Default Credentials is an alternative to service account From the official documentation: “There are two ways to obtain credentials for the agent to use: - Let the agent use a service account with private-key authentication - Let the agent use application default credentials (ADC).”
• Application Default Credentials is an alternative to service account keys From the official documentation: “When developers are locally iterating on Terraform configuration, they should authenticate by running [`gcloud auth application-default login`](https://cloud.google.com/sdk/gcloud/reference/auth/application-default/login) to generate application default credentials. Don't…”
• Cloud Run works with gcloud CLI From the official documentation: “This command obtains a service account key from an environment variable and then uses the gcloud CLI to deploy the application to Cloud Run.”
• Cloud Run works with service account From the official documentation: “Map a custom Service Account to a Cloud Run service”
• Cloud Run works with Workload Identity Federation From the official documentation: “This tutorial describes how to use Workload Identity Federation to authenticate workloads that run outside of Google Cloud so that they can access microservices hosted by Cloud Run.”
• Cloud Storage works with Workload Identity Federation for GKE From the official documentation: “For example, consider a Kubernetes workload that uses Workload Identity Federation for GKE to store data in a Cloud Storage bucket.”
• credential configuration file depends on Workload Identity Federation From the official documentation: “Use a [credential configuration file](https://google.aip.dev/auth/4117) to configure an external application to impersonate a service account. This option is only available for applications that use [Workload Identity Federation](/iam/docs/workload-identity-federation).”
• gcloud CLI depends on credential configuration file From the official documentation: “The [Cloud Client Libraries](/apis/docs/cloud-client-libraries) and the gcloud CLI can automatically obtain external credentials and use these credentials to impersonate a service account. To let libraries and tools complete this process, you must provide a credential…”