Cloud Security Basics
Service accounts & security
Shared responsibility, identity, data, platform, logging, and audit foundations
Ten 2020–2021 episodes explaining how provider protections and customer controls fit together: identity, data access, hardware, service accounts, security logging, and audit trails.
Google Cloud Tech 8 of 10
In this collection Browse 10 summaries 8 of 10
This episode presents service accounts as dedicated identities for applications and scripts, separating workload access from a person's reusable credentials.
Key Points Covered
- Do not make a script depend on a person's credentials: If automation stores those credentials, anyone who obtains them may use the person's access for something else. Sharing the script can also mean sharing the credentials it needs 01:02–02:04(opens in a new tab).
- Give applications dedicated identities with limited permissions: A service account can call APIs without exposing a user's credentials. Administrators control both what it can access and who can use it; the episode recommends reviewing that access regularly 02:04–04:12(opens in a new tab).
- Attaching an identity avoids distributing a key file: For Google Cloud workloads, the episode recommends attaching a service account to the resource so the platform handles authentication. Downloading a key instead creates a file whose storage and access must be protected, much like a password 03:08–05:15(opens in a new tab).
- If keys are unavoidable, handle them deliberately: Its 2021 advice covers secure storage, avoiding source-control commits, and rotation; this is historical guidance, not a current endorsement of long-lived keys 04:12–05:15(opens in a new tab).
- Track the identity lifecycle: Descriptive naming, usage logging, and disabling unused service accounts help reduce forgotten access 05:15–07:22(opens in a new tab).
Full video: https://www.youtube.com/watch?v=wEGZXSd4uS4(opens in a new tab)