28 ms·
They denied my request for a service account quota increase even though my use case[1] was literally straight from their documentation. They only increased it a
by agwa 8mo ago
They denied my request for a service account quota increase even though my use case[1] was literally straight from their documentation. They only increased it after I complained on Twitter and got retweeted by Corey Quinn.
[1] https://www.agwa.name/blog/post/accessing_your_customers_google_cloud_accounts https://www.agwa.name/blog/post/accessing_your_customers_goo...
- vrosas 8mo agoWhy didn’t you just have the customer create a service account and then send you the key? Or you’d just have one master service account and the customer would give you permission to impersonate the one they created? I’m sorry you ran into this but there were other solutions.
- agwa 8mo agoHaving the customer send me the key is less secure because that key never gets rotated. Google wants to discourage long-lived credentials so badly that new organizations can't even create service account keys by default anymore. Having the customer grant permission to a single master service account is vulnerable to confused deputy attacks. In any case, why should I have to pursue "other solutions" to something that's in their documentation?