As google project owner, what are best practices to give myself least privileges?

user_1210075 0
Viewed 36

I am the owner of a google project, and also one of the developers. At times I would like to give my local machine access to run code for various configuration, testing, and maintenance operations via google client libraries on my production environment, e.g.:

from google.cloud import storage
storage.Client()
...

There are two ways I've been doing this:

gcloud auth application-default login and via GOOGLE_APPLICATION_CREDENTIALS by creating a service account and then downloading its json private key and setting the environment variable.

Both make me nervous about accidentally running code that could damage my production environment.

I'm not sure how to give myself least privileges when I'm also the project Owner, and how to carefully turn on/off privileges. Perhaps I shouldn't be doing anything on Production from my local machine, and only running code in cloud instances that are more controlled?

What do people typically do to manage both development and production google projects? I'm leaning towards creating a service account that I manually add/remove from my production IAM as needed, but I've read that the use of service accounts and local private key json files is also risky.

Are there ways to use OAuth that use my personal credentials but restrict scope/access for a specific session?

google-iam google-cloud-platform
1 Answers

I assume you don't have access to Google Workspace.

YOu could create a(nother) Google user (commercial) account solely for project ownership?

NOTE You needn't get another Gmail address. The signup flow includes the option to use an existing email address. In this case, your@not-gmail.com gets wrapped with a Google account (and distinct password|2FA).

Service Account Keys carry risk because they're bearer credentials and so you need to be judicious with their management. It's good practice to only create keys when you must and to delete|cycle them promptly. However, a Service Account Key is generally (!) more secure than using gcloud auth application-default because generally (!) Service Accounts are granted fewer permissions than user (e.g. Owner) accounts. See Workload Identity Federation for another approach.

It used to be that Service Accounts were not fully interchangeable with User accounts. Service Accounts used to not be permitted to be Project Owners (this is no longer true). I think there are still cases where Service Accounts are not equivalent (when GCP requires sending e.g. terms of service emails).

user_6092900
Related