A GitHub Actions workflow needs to deploy to Google Cloud without a stored service account key. What do you use?
Why C is the answer
Workload Identity Federation
Federation exchanges the external identity for short-lived credentials, so there is no key to leak.
In detail
- Workload Identity Federation deploys with short-lived credentials.
- Limit which repository can do this.
Use case
An illustrative scenario, not a real incident.
A deployment workflow exchanges its GitHub identity for short-lived Google credentials, so no key exists.
See it in different ways
sequenceDiagram participant E as External workload participant S as Security Token Service participant G as Google Cloud API E->>S: External identity token S-->>E: Short-lived token E->>G: Call with the token
sequenceDiagram participant G as GitHub Actions participant W as Workload Identity Federation participant C as Google Cloud G->>W: Identity token from the workflow W-->>G: Short-lived credentials G->>C: Deploys
sequenceDiagram participant P0 as GitHub Actions participant P1 as Workload Identity Federation participant P2 as Google Cloud P0->>P1: External identity P1-->>P0: Short-lived credential P0->>P2: Deploy
Key point: Federation removes stored keys.
Why the other options are wrong
- A. A key in repository secrets
- That is a stored key.
- B. A key in the code
- A key in code is exposed.
- D. An API key
- An API key does not deploy resources.