Question

A data engineering team runs an on-premises batch job that must call the BigQuery API in Google Cloud. Security policy prohibits downloading and distributing long-lived service account key files. The on-premises environment cannot be enrolled in workload identity federation because it uses a legacy authentication broker that already holds valid Google credentials for a central automation service account. The team needs the batch job to act as a dedicated BigQuery service account without any exported key material. What is the most appropriate way to grant this access?

Accepted Answer

Grant the central automation service account the roles/iam.serviceAccountTokenCreator role on the dedicated BigQuery service account, and have the job generate short-lived access tokens through impersonation.

Answer

Create a user-managed key for the BigQuery service account, encrypt it with Cloud KMS, and store the ciphertext in the on-premises secret store for the job to decrypt at runtime.

Answer

Grant the central automation service account the roles/iam.serviceAccountUser role on the BigQuery service account so it can attach and run as that identity.

Answer

Add the central automation service account to a Google group that holds the roles/bigquery.dataEditor role and let the job inherit access directly.