Question

Your organization runs a legacy on-premises batch application that cannot use Workload Identity Federation. It authenticates to Google Cloud APIs using a downloaded service account key. Security has flagged that the key has not been rotated in over a year, and they require a repeatable, automated process that minimizes the window during which any single key is valid while avoiding application downtime. Which approach should you implement?

Accepted Answer

Build an automated pipeline that creates a new service account key, distributes it to the application, verifies successful authentication, and then deletes the previous key on a scheduled cadence.

Answer

Enable an organization policy constraint to disable service account key creation, forcing the application to migrate to Workload Identity Federation immediately.

Answer

Grant the on-premises application's service account the Owner role so the key never needs rotation, and enable audit logging to detect misuse.

Answer

Store the single long-lived key in Secret Manager and rely on Secret Manager versioning, keeping the same underlying service account key indefinitely.