Question

A financial services company runs a data-processing pipeline where an application on a Compute Engine VM needs to occasionally write results to a specific BigQuery dataset. Security policy forbids downloading long-lived service account key files and requires that access follow least-privilege principles. Developers must also be able to run the pipeline locally for testing using their own corporate identities without holding the pipeline's permissions permanently. What is the most secure design to grant the necessary access?

Accepted Answer

Create a dedicated service account with only the BigQuery Data Editor role on the target dataset, attach it to the VM, and grant developers the Service Account Token Creator role so they can impersonate it when needed.

Answer

Create a service account with the BigQuery Admin role, generate a JSON key file, and distribute it to the VM and to each developer's workstation.

Answer

Grant the Compute Engine default service account the Project Editor role and have developers use their own Owner permissions when testing locally.

Answer

Add each developer and the VM's default service account directly to the dataset with the BigQuery Data Owner role and store credentials in Secret Manager.