How do you give a cloud worker only the permissions it needs?

How do you give a cloud worker only the permissions it needs?

The person or automation deploying a worker and the worker running a job have different responsibilities. Their permissions should reflect that distinction.

Define runtime access

List the operations the worker needs: reading job data, retrieving inputs, writing outputs, and updating status. Use a dedicated service identity where supported and grant the required resource access. External services such as R2 may use separate credentials that also need appropriate scope.

Verify the boundary

Test permitted operations with the runtime identity, not only an administrator’s account. Confirm that unrelated resources remain inaccessible. Document which configuration each deployment consumes and avoid logging secrets. Google Cloud’s service-identity documentation explains how runtime identities authorize access to Google Cloud APIs; it does not automatically grant permission to external storage or databases.

Further reading: Google Cloud service identity.