Service Account Key vs Workload Identity Federation for least‑privilege VM access to a single Cloud Storage bucket
The goal is to grant a Compute Engine VM read‑only access to a single Cloud Storage bucket while adhering to least‑privilege principles. Two documented approaches are available: (1) create a service account, download its JSON key file, and attach the key to the VM; (2) configure Workload Identity Federation so the VM obtains short‑lived OAuth tokens from an
google