Question

Your company runs its CI/CD pipeline on an external SaaS platform (GitHub Actions) that is outside Google Cloud. The pipeline needs to deploy artifacts to a Cloud Storage bucket and update a Cloud Run service in your Google Cloud project. Your security team has a strict policy prohibiting the creation and download of long-lived service account keys. What is the most secure approach to grant the external pipeline access to these Google Cloud resources?

Accepted Answer

Configure a workload identity pool and provider that trusts GitHub's OIDC tokens, then grant the pipeline's identity the ability to impersonate a service account with the required roles.

Answer

Create a service account, generate a JSON key, and store it as an encrypted secret in the GitHub Actions repository.

Answer

Create a Google user account for the pipeline, enable 2-step verification, and store the credentials in the CI/CD platform's secret manager.

Answer

Grant the GitHub Actions IP ranges access through a VPC firewall rule and assign roles directly to those IP addresses.