Question

Your platform team is bootstrapping a new Google Cloud organization with Terraform. A workload running on a Compute Engine VM in one project needs to write objects to a Cloud Storage bucket in another project. Security policy prohibits creating and storing any long-lived service account keys. How should you configure the service account for this workload?

Accepted Answer

Create a dedicated user-managed service account, attach it to the VM, and grant that service account roles/storage.objectAdmin on the bucket in the other project.

Answer

Create a user-managed service account, generate a JSON key with Terraform, and store the key in Secret Manager for the VM to download at boot.

Answer

Use the Compute Engine default service account and grant it the Editor role at the organization level so it can access all buckets.

Answer

Create a service account key, embed it in the VM's startup script metadata, and rotate it manually every 90 days.