Question

A development team is deploying an application on Compute Engine that must call the BigQuery API to read data. The security lead wants the application to authenticate to Google Cloud APIs without any developer embedding long-lived credential files or passwords in the code or on the VM. Which IAM approach best meets this requirement?

Accepted Answer

Attach a service account to the VM and grant it the necessary BigQuery role, letting the application obtain credentials automatically

Answer

Create a user account for the application and store its password in an environment variable on the VM

Answer

Generate a downloadable service account key file and copy it into the application's source repository

Answer

Grant the Project Owner basic role to every developer so they can share their personal credentials with the app