How securely to keep google cloud service account key?

Question

How securely to keep google cloud service account key?

I want to ask about how we should securely keep service account key. The scenario looks like:

• Our product is connecting to BigQuery.
• We have project which is used only by developers as playground.
• We need to run integration tests in pipelines and they needs service account to run correctly.
• Developer also should be able to run integration tests locally.

Where should I put the service account key?

I can add it to our repository, but I'm not sure if this solution is ok. (even it is only key with read-only permission to developer version of BigQuery).

The second solution is create a few keys. And every developer should has own. Then every developer have to care about key himself (and we can easy remove key when developer i.e quit job)

Answer 1

I would recommend you use their Google Cloud Secrets Engine. Documentation is here: https://www.vaultproject.io/docs/secrets/gcp/index.html

Managing such sensitive secrets by any means other than a Vault service is dangerous.

Answer 2

Add the service account key to you repository is not a good practice when thinking about security.

The second solution may happen and should be a good practice to implement some key rotation process to avoid some dev using a compromised key. Even though, there are some guidance which suggests to avoid the utilization of several keys (Also, I suppose there's a limit in the platform for Service Account key creation)

Take a look at Cloud KMS that may have some suggestion for you on how to manage your keys