Question

Your team uses a single Cloud Deploy delivery pipeline that promotes releases across three targets: dev, staging, and prod, each in a separate GCP project. Security requires that the deployment to prod use a dedicated, least-privilege identity that has no permissions in dev or staging, and vice versa. During rendering and deployment, Cloud Deploy currently runs everything with the default Compute Engine service account, which has broad access. What is the recommended way to enforce distinct, least-privilege identities for each target's operations?

Accepted Answer

Configure an execution configuration on each target that specifies a target-specific service account and worker pool, granting each service account only the permissions needed in its project.

Answer

Create separate delivery pipelines per environment, each hardcoded with a different service account key stored in Secret Manager.

Answer

Assign IAM conditions on the default Compute Engine service account that restrict access based on the target name in the request.

Answer

Use Cloud Build triggers with per-branch service accounts and skip Cloud Deploy's rendering step entirely.