Question

Your company runs a data-processing application on Amazon EC2 instances that needs to read objects from a Cloud Storage bucket in your Google Cloud project. Security policy prohibits creating or distributing long-lived service-account keys. What is the recommended way to grant the EC2 workloads access?

Accepted Answer

Configure workload identity federation with an AWS workload identity pool so the EC2 instances exchange their AWS credentials for short-lived Google Cloud access tokens.

Answer

Create a service-account key, encrypt it, and store it in AWS Secrets Manager for the EC2 instances to use.

Answer

Assign a Google Cloud service account directly to the EC2 instances as their instance profile.

Answer

Create a user account for the application in Cloud Identity and generate an OAuth refresh token that the EC2 instances store locally.