Which identity type lets a workload authenticate to Google Cloud APIs without any human-held password, with Google handling the authentication behind it?
Show answer and explanation
Answer: D
A service account is an identity for an application or workload. It has no password that a person types, and Google handles the authentication behind it. Workloads running on Google Cloud can obtain short-lived tokens from an attached service account. That makes service accounts the standard identity for automated processes that call Google Cloud APIs.
Why the other options are wrong
- A. A personal Google Account belongs to one human and is secured with that person's sign-in. An unattended workload is not a person, so this is the wrong identity type.
- B. Federated identities come from an external provider that issues assertions about users. The provider, not Google Cloud, manages those sign-ins, so this is not the Google-managed type asked about.
- C. A Cloud KMS key version is used for encryption and signing, not as an identity. It cannot be used to authenticate a workload to APIs.