You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also…

Question

Options

• ACreate a new Service account, and give all application users the role of Service Account User.
• BCreate a new Service account, and add all application users to a Google Group. Give this group
• CUse a dedicated G Suite Admin account, and authenticate the application's operations with these
• DCreate a new service account, and grant it G Suite domain-wide delegation. Have the application

• A
  5% (1)
• B
  5% (1)
• C
  10% (2)
• D
  81% (17)

Explanation

Creating a service account with G Suite (now Google Workspace) domain-wide delegation (D) is Google's recommended approach for server-to-server scenarios requiring delegation. The service account can impersonate any user in the domain and act on their behalf (e.g., access their Drive) without needing their credentials at runtime. This satisfies the requirement that the app does not rely on the current user's credentials. Option A grants users the Service Account User role, which allows them to act as the service account - the opposite of what is needed. Option B uses a group but still doesn't solve the delegation problem. Option C using a dedicated admin account is not recommended (credential management risk, not scalable, not a Google best practice).

No community discussion yet for this question.