Question

A development team has an application running on-premises that needs to authenticate to Google Cloud APIs using a service account. Company policy prohibits embedding credentials directly in application source code or configuration files that are committed to the repository. The team must securely store the service-account key and retrieve it at runtime. Which approach best satisfies these requirements?

Accepted Answer

Store the service-account key JSON file in Secret Manager and have the application fetch it at runtime using appropriate IAM permissions.

Answer

Base64-encode the service-account key and store it as an environment variable in the deployment script committed to the repository.

Answer

Place the service-account key in a Cloud Storage bucket with public read access so the application can download it.

Answer

Grant the on-premises application the Editor basic role directly on the project so no key is needed.