Question

Your platform team runs a CI/CD pipeline in a dedicated 'ci-tools' project. The pipeline must deploy resources into multiple environment projects (dev, staging, prod), each in different folders. Security policy forbids downloading or storing service account JSON key files anywhere, and each environment must have distinct permissions that can be audited. How should you configure the service accounts so the CI/CD workload can deploy across the environment projects?

Accepted Answer

Grant the CI/CD workload's identity the Service Account Token Creator role on a per-environment deployer service account in each project, and use short-lived impersonation tokens to deploy.

Answer

Create one service account per environment project and generate long-lived JSON keys, storing them as encrypted secrets in the CI/CD system for each deployment target.

Answer

Add the single ci-tools service account as an Owner at the organization level so it inherits deploy permissions on all environment projects.

Answer

Create a shared service account in the ci-tools project and grant it Editor across all three environment projects using a group binding at the folder level.