-1

The question is specifically about the case where developers need to access GCP from their workstations (Firestore, Stackdriver, KMS...).

In Google Cloud documentation, it is usually stated:

Developer workstation: Authenticating by using a service account is also recommended for your developer workstation.

How should we handle the case when a developer gets fired?

  • Should we have a service account per developer?
  • How to provision these service accounts to developers?
  • Or is it actually better to go against the docs and authenticate using developer accounts?
John Hanley
  • 74,467
  • 6
  • 95
  • 159
Nikola Mihajlović
  • 2,286
  • 2
  • 19
  • 23
  • I'm voting to close this question as off-topic because this is not a programming question but Google account administration. – Rob Nov 24 '19 at 12:17
  • 1
    @Rob - I respectfully disagree. Developers need to understand how to set up credentials and API Keys. This is a vital first stage step in programming. – John Hanley Nov 24 '19 at 18:35

1 Answers1

3

The best answer requires far more details then your question provides. This answer serves as a general-purpose answer that applies to typical small scale usage of Google Cloud.

For enterprise-class development with multiple accounts, projects, hundreds of resources, etc. would require a different answer that includes organizations, folders, federations, SSO, VPNs, etc.

How should we handle the case when a developer gets fired?

Delete/Disable the developer's service account JSON key. Remove the user's IAM member account (email address) from having rights in Google Cloud.

Should we have a service account per developer?

Yes, you should create and issue one service account key per developer. Just like you would create separate login accounts for each user. You should also issue separate SSH keys to each developer for logging into Compute Engine instances.

How to provision these service accounts to developers?

You can create service accounts in the Google Cloud Console, the Google Cloud SDK CLI gcloud or via APIs.

Or is it actually better to go against the docs and authenticate using developer accounts?

No - listen to the documentation. You can use User Accounts for the CLI gcloud but for any software written using SDKs/APIs, you should use service accounts. The Google SDKs will print warnings on the console about the usage of user credentials. If you plan to deploy software in the cloud you need to use (usually) service accounts. Invest the time now to do things correctly and securely. This will minimize headaches and problems later.

There are exceptions to everything I said. However, until you have a solid understanding of Google Cloud IAM and Security, follow the best practices. Google Cloud Authentication is very complex and an expert developer could create backdoors into GCP if you try to take shortcuts.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • Thank you for your answer. Thinking on it, one argument to use service accounts vs developer accounts is when developer has a wide range of permissions (such as project editor), while we want a service account to be restricted (e.g. only Firestore). – Nikola Mihajlović Nov 24 '19 at 20:03
  • @NikolaMihajlović - Security Principles of Least Privilege. Grant only the permissions required to perform the task. Re-read the last sentence in my answer. Project Editor is a role where I can create backdoors into GCP. Only "trusted" developers should not have that level of privilege. I do not grant that privilege to myself. I use separate credentials when I want Project level rights. For day-to-day work, I use very restricted credentials. – John Hanley Nov 24 '19 at 20:14