Question

Your company runs a batch analytics workload on an on-premises Hadoop cluster that must read data from a Cloud Storage bucket. The security team has mandated that no long-lived service account keys be created or distributed to external systems. The on-premises identity provider issues OIDC tokens for the cluster's service identity. What is the recommended way to grant the on-premises workload access to Cloud Storage while satisfying the security mandate?

Accepted Answer

Configure a workload identity pool with an OIDC provider mapping the cluster's tokens, and grant the pool identities access to the bucket via impersonation of a service account.

Answer

Create a service account, generate a JSON key, and securely store it in the on-premises cluster's secrets manager.

Answer

Add the on-premises cluster's identity as a member directly in the bucket IAM policy using its OIDC subject claim.

Answer

Create a Cloud Identity user for the cluster and use its credentials with the gcloud CLI to authenticate to Cloud Storage.