A developer is building a Python service on a laptop that reads objects from Cloud Storage and calls Pub/Sub. The team forbids long-lived key files on developer machines. What should the developer do so the client libraries authenticate?
Show answer and explanation
Answer: B
Application Default Credentials is the lookup chain Google client libraries use to find credentials. Running gcloud auth application-default login stores the developer's own user credentials in a well-known location, so the libraries authenticate without any key file. When the same code later runs on Google Cloud, the attached service account is used automatically. Long-lived service account keys are discouraged by policy, hardcoded API keys are insecure, and a firewall rule does not authenticate API calls.
Why the other options are wrong
- A. A downloaded service account key is a long-lived secret that the team has forbidden on developer machines. Pointing an environment variable at it also increases the risk of leaking the key.
- C. An API key in source code is exposed to anyone who reads the repository, and API keys do not carry the identity needed to check fine-grained IAM permissions.
- D. Firewall rules control network traffic to VM instances. They do not authenticate calls to Google APIs such as Cloud Storage or Pub/Sub, which are reached over the public API endpoints.