You need to deploy resources from your laptop to Google Cloud using Terraform. Resources in your Google Cloud environment must be created using a service account. Your Cloud Identity has the roles/iam

Question

Options

• A
  1. Download the service account's key file in JSON format, and store it locally on your laptop.
• B
  1. Run the following command from a command line: gcloud config set
• C
  1. Run the following command from a command line: gcloud auth application-default login.
• D
  1. Store the service account's key file in JSON format in Hashicorp Vault.

• A
  5% (3)
• B
  80% (51)
• C
  2% (1)
• D
  14% (9)

Explanation

With the roles/iam.serviceAccountTokenCreator role, the recommended Google best practice is service account impersonation: configure gcloud to impersonate the target service account (e.g., gcloud config set auth/impersonate_service_account SA_EMAIL), then use Application Default Credentials (ADC). This generates short-lived, automatically expiring tokens on behalf of the service account without ever downloading a long-lived key file. Option A (download a JSON key file) creates a long-lived static credential that must be securely stored and manually rotated - this is explicitly discouraged by Google. Option C (gcloud auth application-default login) authenticates as the human user's Cloud Identity, not the required service account. Option D (HashiCorp Vault) adds significant operational complexity without leveraging the native impersonation capability already in place.

No community discussion yet for this question.