Terraform 中的 GCP 服务帐户密钥管理和使用

Question

I am creating CI/CD pipeline for Terraform so that my GCP resource creation would be automated. But Terraform needs Service account to do the job, I create the service account and the key is downloaded to my machine, but what should be the correct way to store it so when running Cloud build pipeline so that Terraform would pick on it and execute scripts.

provider "google" {
  credentials = file(var.cred_file)
  project     = var.project_name
  region      = var.region
}

Is it okay to store this file in Cloud storage bucket ? Or there are some better alternatives ?

Answer 1

On GCP you have the bucket option to keep sensitive information and you can use access control lists (ACLs) to define who has access on your buckets and objects. GCP offers the next options to storage and I think that the better is according with your needs, just ensure that the option provides you the security tools to keep your files safe. I think that once you are Granting permissions to your Cloud Build service account , you can pass the path to the service account key in code