Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ376

Integrating applications with Google Cloud services

Your application requires service accounts to authenticate to GCP products by using credentials stored on its host Compute Engine virtual machine instances. You want to distribute these credentials to the host instances as securely as possible.

What should you do?

  • A Use HTTP signed URLs to securely provide access to the required resources.
  • B Use the instance's service account Application Default Credentials to authenticate to the required resources.
  • C Generate a P12 file from the GCP Console after the instance is deployed, and copy the credentials to the host instance before starting the application.
  • D Commit the credential JSON file into your application's source repository, and have your CI/CD process package it with the software that is deployed to the instance.
Explanation

For production workloads on Compute Engine, attach a least-privileged service account to the VM and use Application Default Credentials. ADC retrieves short-lived credentials for the attached service account through the metadata server, so no long-lived P12 or JSON service-account key must be copied to the instance or included in source and deployment artifacts.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!