-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Cloud Native Automation with Google Cloud Build
By :

When builds run and interact with other Google Cloud resources, by default they utilize the Cloud Build service account as their identity, to which their permissions are assigned.
This, however, does not enable builds or users to apply POLP; if you have one GCP service account that is used by multiple builds that perform different tasks or interact with different resources, then all builds that use that service account will be overly privileged.
Cloud Build has support for per-build or per-trigger service accounts; this enables you to create each service account with intention and according to POLP.
This principle ensures that each build has no more permissions than the minimal amount it requires to execute successfully; this is achieved with purpose-specific GCP service accounts.
Let’s begin by creating two GCP service accounts, with one for each team we simulate in this example.
As...