google-cloud-recipe-auth

Guide authentication and authorization for Google Cloud resources using ADC and service accounts.

4|Updated Jul 16, 2012

Search Tags:#authorization #authentication #iam #google-cloud #federation #service-accounts #application-default-credentials

Ready to run

npx skills add https://github.com/takashabe/dotfiles --skill google-cloud-recipe-auth-takashabe

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: google-cloud-recipe-auth
Source: https://github.com/takashabe/dotfiles/tree/main/.claude/skills/google-cloud-recipe-auth
Command: npx skills add https://github.com/takashabe/dotfiles --skill google-cloud-recipe-auth-takashabe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Guides teams to securely authenticate and authorize access to Google Cloud resources for humans, services, and applications.

Core Features & Use Cases

Human authentication methods (Cloud Identity accounts, Federation, Workforce Identity Federation)
Service-to-service authentication (Service Accounts, Service Agents, and best practices for key management and impersonation)
Application Default Credentials (ADC) usage and recommended patterns to avoid long-lived keys

Quick Start

Configure ADC locally with gcloud and verify authentication against a Google Cloud API using your preferred client library.

Frequently Asked Questions about google-cloud-recipe-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure Application Default Credentials for Google Cloud services?▼

Configure Application Default Credentials (ADC) locally using gcloud to authenticate client libraries against Google Cloud APIs, avoiding long-lived keys by relying on environment-provided credentials for secure service access.

What is the best way to authenticate CI pipelines to Google Cloud without service account keys?▼

Use Workforce Identity Federation or service account impersonation to authenticate CI pipelines without long-lived service account keys, granting temporary access by exchanging external tokens for Google Cloud credentials.

When should I use service account impersonation instead of default credentials?▼

Use service account impersonation when a user or service needs temporary elevated access to Google Cloud resources without managing long-lived keys, unlike Application Default Credentials which rely on the local environment identity.

Does this guidance cover authentication for Compute Engine, Cloud Run, and GKE?▼

Yes, this guidance covers secure authentication and authorization for developers, operators, and CI pipelines working across Compute Engine, Cloud Run, GKE, and serverless apps requiring correct ADC usage.

How does Workforce Identity Federation work for human authentication in Google Cloud?▼

Workforce Identity Federation lets human users authenticate to Google Cloud using external identity providers, eliminating the need for Cloud Identity accounts or long-lived service account keys for secure resource access.