Question

Your platform team runs a single Cloud Build project that hosts triggers for dozens of application repositories. Currently all triggers execute using the default Cloud Build service account, which has broad Editor-level permissions across the project. A security audit flags this as excessive: a compromised build for one low-privilege app could push images and deploy to resources belonging to other teams. You must reduce blast radius while keeping each pipeline able to perform only the actions it needs. What should you do?

Accepted Answer

Create a dedicated user-managed service account per trigger with only the IAM roles that build needs, and configure each Cloud Build trigger to run as that service account.

Answer

Keep the default Cloud Build service account but remove the Editor role and grant Owner so builds cannot be blocked by missing permissions.

Answer

Move every application into its own Google Cloud project so the shared default service account is isolated by project boundary.

Answer

Export a JSON key for the default service account and store it in Secret Manager, then have each build authenticate with the key it needs.