A GitHub Actions workflow runs Terraform against production projects. Security policy forbids storing long-lived JSON keys in repository secrets. Which approach meets the policy?
Show answer and explanation
Answer: C
Workload Identity Federation lets the pipeline exchange its identity token from GitHub's OIDC issuer for short-lived Google credentials. The pipeline then impersonates a dedicated deployer service account, so no key file is created, stored or rotated. Access can be restricted further by attribute conditions on the provider.
Why the other options are wrong
- A. Base64-encoding does not protect the credential, which remains a long-lived key that can be copied from the secret store. This is exactly what the policy prohibits.
- B. Using a personal login ties automation to one human, grants excessive privilege, and breaks when that person leaves. Owner on the project is far broader than a deploy pipeline needs.
- D. Hourly keys are still service account keys stored outside Google Cloud and handled by a scripted process. The policy targets key material, so rotating it more often does not solve the problem.