Question

A retail company runs its CI/CD pipeline on an external SaaS platform (GitHub Actions) hosted outside Google Cloud. The pipeline must deploy artifacts to Cloud Storage and update Cloud Run services in a production project. The security team has issued a policy forbidding the creation or download of long-lived service account keys, citing the risk of leaked credentials in the external system. Which approach lets the external pipeline authenticate to Google Cloud while complying with this policy?

Accepted Answer

Configure Workload Identity Federation with a workload identity pool that trusts the external platform's OIDC provider, and grant the pipeline the ability to impersonate a service account using short-lived tokens.

Answer

Create a service account key in JSON format, encrypt it with a Cloud KMS key, and store it as an encrypted secret in the external CI/CD platform.

Answer

Create a service account key, set an Organization Policy to auto-rotate the key every 24 hours, and distribute the current key to the pipeline daily.

Answer

Grant the external pipeline's static IP address a firewall allow rule and assign IAM roles directly to that IP so no credentials are needed.