Question

Your company runs its CI/CD pipelines on an external SaaS platform (GitHub Actions) hosted outside Google Cloud. The pipelines must deploy resources into several Google Cloud projects. Your security team has issued a mandate: no long-lived service account keys may be created, stored, or distributed anywhere. You need the external pipeline to authenticate to Google Cloud and act as a service account that has deploy permissions. What should you configure?

Accepted Answer

Configure Workload Identity Federation with a workload identity pool and provider that trusts the GitHub OIDC issuer, then grant the external identity permission to impersonate the deploy service account.

Answer

Create a service account key in JSON format, store it as an encrypted secret in GitHub, and rotate it every 30 days with an automated job.

Answer

Create a user account for the pipeline, enable 2-Step Verification, and have the pipeline log in with stored credentials to obtain access tokens.

Answer

Run a self-hosted GitHub runner on a Compute Engine VM and attach a service account so the pipeline inherits the VM's metadata-server credentials.