What is recommended use of Service account Key to access GCP Storage from another CSP

Google Cloud Compute Infrastructure
1
  • Sequence flow on how Service account is used to access GCP bucket from Other Cloud
  • How to secure pvt key ( secret management)
  • How to rotate Key on expiration with automation

Is Service Account Key = PVT Key = Key from RSA Key Pair ?

Note: I do not want to use external iDP

1 Like
2

Hello @avindia ,Welcome on Google Cloud Community.

You should not use Service Keys for that. You should use Workload Identity Federation. Service Keys are good for testing and IF you have proper key rotation policy in place. But for production load, use Workload Identity Federation. More info here: https://cloud.google.com/iam/docs/workload-identity-federation

–
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

1 Like
3

Thanks it seems using workload identity federation is not used by my Client Org due to complexity with iDP. Hence I would like to see automation option for key rotation and save pvt key using some secrets management. I am also exploring if “Short Lived credentials” can be used instead or Service account impersonation is something make more sense