Question

A data engineering team runs batch jobs from a Compute Engine instance in project 'analytics-prod'. The jobs must read from BigQuery datasets owned by a separate project, 'finance-prod', which is managed by a different team. Security policy forbids creating or downloading service account keys, and the finance team wants to control exactly which identity can access their data. What is the most secure way to grant the batch jobs the required access?

Accepted Answer

Grant the analytics-prod instance's attached service account the roles/iam.serviceAccountTokenCreator role on a dedicated service account in finance-prod that holds BigQuery read access, and have the jobs impersonate it.

Answer

Create a service account in finance-prod, generate a JSON key, and store it on the analytics-prod instance for the jobs to authenticate with.

Answer

Add the analytics-prod instance's service account directly as an owner on the finance-prod project so it inherits all data permissions.

Answer

Enable workload identity federation between the two projects and map the Compute Engine instance as an external identity provider.