What is a GCP service account key and why should you avoid it?
Interviewer Expectations for this Question
01
Core Competency
Assesses fundamental understanding of Google Cloud conventions, runtime behavior, and memory/performance considerations.
02
Evaluation Criteria
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
Comprehensive Model Answer
Verified Solution
A service account key is a downloadable JSON file containing a private key that lets any holder authenticate as that service account. It is long-lived and does not expire unless you delete it.
Why to avoid keys:
- They are bearer credentials; if leaked, an attacker gets the account's permissions until the key is revoked.
- They are hard to rotate and audit, and often end up in source control or CI logs.
- Google recommends workload identity instead.
Better options:
- Attach a service account to Compute Engine, GKE, or Cloud Run so the workload gets short-lived tokens automatically.
- Use Workload Identity Federation to let external workloads, such as GitHub Actions, exchange their identity for GCP tokens.
- If a key is unavoidable, store it in Secret Manager, restrict access, and rotate regularly.
gcloud iam service-accounts keys list --iam-account=sa@proj.iam.gserviceaccount.com
Treat keys as a last resort.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.