How securely to keep google cloud service account key?

I want to ask about how we should securely keep service account key. The scenario looks like:

  • Our product is connecting to BigQuery.
  • We have project which is used only by developers as playground.
  • We need to run integration tests in pipelines and they needs service account to run correctly.
  • Developer also should be able to run integration tests locally.

Where should I put the service account key?

I can add it to our repository, but I'm not sure if this solution is ok. (even it is only key with read-only permission to developer version of BigQuery).

The second solution is create a few keys. And every developer should has own. Then every developer have to care about key himself (and we can easy remove key when developer i.e quit job)

2 Answers 2


I would recommend you use their Google Cloud Secrets Engine. Documentation is here: https://www.vaultproject.io/docs/secrets/gcp/index.html

Managing such sensitive secrets by any means other than a Vault service is dangerous.


Add the service account key to you repository is not a good practice when thinking about security.

The second solution may happen and should be a good practice to implement some key rotation process to avoid some dev using a compromised key. Even though, there are some guidance which suggests to avoid the utilization of several keys (Also, I suppose there's a limit in the platform for Service Account key creation)

Take a look at Cloud KMS that may have some suggestion for you on how to manage your keys

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.