skills.rest
Aki2022
Aki2022COMMUNITY
Explore all skills by this author →
GitHub

google-cloud-recipe-auth

Guides authentication and authorization setup for Google Cloud services and APIs.

Updated Dec 9, 2025
Search Tags:#authentication#google cloud#iam#oidc#service account#workload identity federation#application default credentials
One-click install
npx skills add https://github.com/Aki2022/skills --skill google-cloud-recipe-auth-aki2022
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: google-cloud-recipe-auth
Source: https://github.com/Aki2022/skills/tree/main/google-cloud-recipe-auth
Command: npx skills add https://github.com/Aki2022/skills --skill google-cloud-recipe-auth-aki2022

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Choosing the correct Google Cloud authentication method is confusing: developers often misuse service account keys, mix up gcloud CLI auth with Application Default Credentials, or fail to secure production workloads. This Skill provides structured guidance to pick the right identity and credential approach for any scenario. ## Core Features & Use Cases - Human Authentication Guidance: Covers gcloud CLI login, Application Default Credentials for local development, service account impersonation, Workforce Identity Federation, IAP, and Identity Platform. - Service-to-Service Authentication: Explains attaching service accounts to Compute Engine and Cloud Run, Workload Identity Federation for GKE and external clouds, OIDC ID tokens, and short-lived credentials. - Authorization Best Practices: Details IAM allow policies, predefined versus custom roles, API key restrictions, and OAuth 2.0 access scopes. - Use Case: A developer deploying a Cloud Run service that calls Cloud SQL learns to attach a custom least-privilege service account and grant roles/cloudsql.client instead of downloading a service account key. ## Quick Start Ask how to authenticate a Python script running locally to access a Google Cloud Storage bucket.

Frequently Asked Questions about google-cloud-recipe-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I authenticate to Google Cloud from local Python code?▼

Run gcloud auth application-default login to create local Application Default Credentials. Google Cloud client libraries like the Python storage.Client automatically find these credentials, so your code acts as your user identity without any keys.

What is the difference between gcloud auth login and application-default login?▼

gcloud auth login authenticates the gcloud CLI itself for running management commands. gcloud auth application-default login creates a local JSON credential file that client libraries use via Application Default Credentials when running your code.

Should I use service account keys for production workloads?▼

No, avoid downloading service account key files. Instead, attach a custom least-privilege service account directly to the resource such as a Compute Engine VM or Cloud Run service, which provides short-lived tokens via the metadata server.

How do I authenticate workloads running on AWS or Azure to Google Cloud?▼

Use Workload Identity Federation to exchange an external token, such as an AWS IAM role credential, for a short-lived Google Cloud access token. This eliminates the need for static service account keys outside Google Cloud.

Why does my attached service account fail API calls despite correct IAM roles?▼

Legacy Compute Engine VMs and GKE node pools also rely on OAuth 2.0 access scopes alongside IAM. If the VM's scope is restricted, API calls fail even with correct IAM permissions, so check the access scopes first.

How do services call a private Cloud Run application securely?▼

The calling service generates a Google-signed OpenID Connect ID token and passes it in the Authorization Bearer header. The token is created dynamically via the IAM Service Account Credentials API without static credentials.

Related Skills

Explore More Software Engineering Skills→
googlegoogle
19.1k

google-cloud-recipe-auth

Guides authentication and authorization setup for Google Cloud services and APIs.

Official
Intermediate
davila7davila7
30.5k

google-cloud-auth

Guides authentication and authorization setup for Google Cloud services and APIs.

Community
Intermediate
briiirussellbriiirussell
345

secrets-audit

Detect leaked credentials in repositories, Git history, and build artifacts.

Community
Advanced
thangchungthangchung
25

entra-agent-id

Provision Microsoft Entra Agent Identity Blueprints and configure OAuth 2.0 token exchange via Microsoft Graph.

Community
Advanced