Your company uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the…

Relying solely on the Jenkins VM's attached service account might mean the VM has broader permissions than required by Terraform, or insufficient permissions, failing to adhere to least privilege.

Using a Terraform module for Secret Manager to retrieve credentials is a good practice for storing credentials, but the question is about authorizing the Jenkins instance to *use* credentials to create resources, which requires the initial credential setup, not just retrieval.

Creating a dedicated service account for the Terraform instance and downloading its key file allows for granular permissions tailored to Terraform's needs, strictly adhering to the principle of least privilege. While managing key files requires careful handling (e.g., using Secret Manager), this is a common and recommended practice for external systems like Jenkins needing to authenticate as a service account outside of a VM's default service account, ensuring explicit control over the Terraform's identity and permissions.

The `gcloud auth application-default login` command is typically for user authentication, not suitable for automated service account authentication in CI/CD pipelines, and does not follow Google's recommended practices for service accounts.