Question

A developer on your team stored a downloaded service-account JSON key in a local script three months ago to authenticate to Google Cloud APIs. Your security team now requires that no user-managed service-account keys older than 90 days remain active, and they want to minimize the ongoing risk of leaked long-lived credentials. The script runs on a Compute Engine instance in the same project. What should you recommend?

Accepted Answer

Modify the script to run without a downloaded key by attaching the service account to the Compute Engine instance and using the instance's automatically managed credentials.

Answer

Create a new user-managed key each month and update the script, deleting the previous key after rotation.

Answer

Grant the developer's user account the roles the script needs and have them run the script with their own gcloud credentials.

Answer

Store the existing JSON key in Secret Manager and reference it from the script so it is no longer on the local disk.