Question

A development team building a batch job that runs on an on-premises VM needs to authenticate to Google Cloud APIs. A junior developer asks you to help them create and download a service account JSON key so the application can call the APIs. Your organization enforces an org policy that blocks service account key creation. As the cloud architect advising the team, what should you recommend they implement for the on-premises workload?

Accepted Answer

Configure Workload Identity Federation with an external identity provider so the on-premises workload obtains short-lived Google Cloud credentials without a downloaded key.

Answer

Request a temporary exception to the org policy so a single downloadable key can be generated and stored in the application's config file.

Answer

Have the developer run 'gcloud auth login' with their personal Google account on the on-premises VM and reuse those user credentials in the batch job.

Answer

Enable the Compute Engine default service account and attach it to the on-premises VM through the metadata server.