/google-cloud-recipe-auth

name: google-cloud-recipe-auth
metadata:
  version: "1.0.2"
  category: GettingStarted
description: Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

Authenticating and Authorizing to Google Cloud (IAM)

[Authentication](https://docs.cloud.google.com/docs/authentication.md.txt) is the process of proving **who you are**. In Google Cloud, you represent a **Principal** (an identity like a user or a service). This is the first step before [Authorization](https://docs.cloud.google.com/iam/docs/overview.md.txt) (determining **what you can do**).

Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you MUST read [Usage Attribution](references/attribution.md). For commands executed directly in the terminal (never in generated scripts, Terraform, or user code), prefix `gcloud` with `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:google-cloud-recipe-auth)"` and append `agent-skills/1.0 (skill:google-cloud-recipe-auth)` to `User-Agent` headers.

Authentication

Clarifying Questions for the Agent

Before providing a specific solution, clarify the following with the user:

1. **Who or what is authenticating?** (A human developer, a local script, or an application running in production?) 2. **Where is the code running?** (Local laptop, [Compute Engine](https://docs.cloud.google.com/compute/docs.md.txt), [GKE](https://docs.cloud.google.com/kubernetes-engine/docs.md.txt), [Cloud Run](https://docs.cloud.google.com/run/docs.md.txt), or another cloud like AWS/Azure?) 3. **What is the target?** (A Google Cloud API like Storage/BigQuery, or a custom application you built?) 4. **Are you using a high-level client library?** (e.g., Python, Go, Node.js libraries usually handle ADC automatically.)

---

Human Authentication

For users to access Google Cloud, they need an identity that Google Cloud can recognize.

Types of User Identities

Google Cloud supports several ways to configure identities for your internal workforce (developers, administrators, employees):

• **[Google-Managed

Accounts](https://docs.cloud.google.com/iam/docs/user-identities.md.txt)**: You can use Cloud Identity or Google Workspace to create managed user accounts. These are called managed accounts because your organization controls their lifecycle and configuration.

• **[Federation using Cloud Identity or Google

Workspace](https://docs.cloud.google.com/iam/docs/user-identities.md.txt)**: You can federate identities to allow users to use their existing identity and credentials to sign in to Google services. Users authenticate against an external identity provider (IdP), but you must keep accounts synchronized into Google Cloud using tools like Google Cloud Directory Sync (GCDS) or an external authoritative source like Active Directory or Microsoft Entra ID.

• **[Workforce Identity

Federation](https://docs.cloud.google.com/iam/docs/user-identities.md.txt)**: This lets you use an external IdP to authenticate and authorize a workforce using IAM directly. Unlike standard federation, you do not need to synchronize user identities from your existing IdP to Google Cloud identities. It supports syncless, attribute-based single sign-on.

Methods of Access for Developers and Administrators

Used for interacting with Google Cloud resources and APIs during development and management.

• **[Google Cloud Console](https://console.cloud.google.com/)**: The primary

web interface. You authenticate using your Google Account (Gmail or [Google Workspace](https://workspace.google.com/)).

• **[gcloud CLI](https://docs.cloud.google.com/sdk/docs/install-sdk.md.txt) (`gcloud

auth login`)**: Used to authenticate the CLI itself so you can run management commands (e.g., `gcloud compute instances list`). It uses a **Credential** (like an OAuth 2.0 refresh token) stored locally.

• **Local Development with [App Default Credentials

(ADC)](https://docs.cloud.google.com/docs/authentication/application-default-credentials.md.txt) (`gcloud auth application-default login`)**: This is different from CLI auth. It creates a local JSON file that Google Cloud **Client Libraries** (Python, Java, etc.) use to act as "you" when you run code on your laptop.

• **[Service Account

Impersonation](https://docs.cloud.google.com/docs/authentication/use-service-account-impersonation.md.txt)**: For security reasons, developers should avoid downloading Service Account keys entirely. Instead, they should authenticate as humans (`gcloud auth login`) and use Service Account Impersonation to run CLI commands or generate short-lived credentials. This is a critical best practice for local development and troubleshooting.

For End-Users and Customers

Used when a human (who is not a developer) needs to access a web application you've deployed on Google Cloud. Note: These are distinct from workforce identities.

• **[Identity-Aware Proxy (IAP)](https://docs.cloud.google.com/iap/docs.md.txt)**:

Acts as a central authorization layer for web applications. It intercepts web requests and verifies the user's identity (via Google Workspace, Cloud Identity, or external providers) before letting them reach the application. It's often used to protect internal apps without a VPN, or secure customer portals.

• **[Identity

Platform](https://docs.cloud.google.com/identity-platform/docs.md.txt)**: A Customer Identity and Access Management (CIAM) solution for adding consumer sign-in (email/password, phone, social) directly into the code of your custom-built applications.

---

Service-to-Service Authentication

When code runs in pro