Question

A developer on your team needs to run a local script that calls the Cloud Storage API as a specific service account named 'batch-processor@project.iam.gserviceaccount.com'. Company security policy forbids downloading or storing service-account keys on developer laptops. The developer already authenticates to gcloud with their own user credentials. What should you do to let the developer's script act as the service account?

Accepted Answer

Grant the developer's user account the 'roles/iam.serviceAccountTokenCreator' role on the service account, then have the script generate short-lived credentials by impersonating the service account.

Answer

Create a new service-account key with 'gcloud iam service-accounts keys create', email it to the developer, and have them set GOOGLE_APPLICATION_CREDENTIALS.

Answer

Grant the developer's user account the 'roles/iam.serviceAccountKeyAdmin' role so they can manage keys for the service account themselves.

Answer

Add the developer's user account as a member with 'roles/owner' on the project so the script inherits the service account's permissions.