如何安全地访问包含服务帐户凭据的 json 文件？

Question

I am trying to create Django project that uses Google Cloud Storage bucket, and deploy it on Heroku or other cloud services.

In order to use Cloud Storage, I need to authenticate myself using the service account. So I got json file containing service account credentials.

In the application, I need to provide a path to that json file, which means that I must save json file within the application.

I can use environment variable to hide the path itself, but I still need the json file saved somewhere in the Django project and when deployed in the remote server. I was not sure if this is safe...

How can I access Google Cloud Storage safely during production?

Answer 1

The reason why one uses environment variables is to make sure sensitive credentials are not shared by an accident via for example GitHub. If someone has access to your server then everything is compromised no matter what.