google-cloud-recipe-auth

Name: google-cloud-recipe-auth
Author: jmxt3

32stars3forks

How to install google-cloud-recipe-auth?

jmxt3/gitscape.ai/google-cloud-recipe-auth

$npx -y skills add jmxt3/gitscape.ai --skill google-cloud-recipe-auth

Installs into the current project.

Summary

Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

Files · 1

View on GitHub

SKILL.md

1	# Authenticating to Google Cloud
2
3	[Authentication](https://docs.cloud.google.com/docs/authentication) is the
4	process of proving who you are. In Google Cloud, you represent a
5	Principal (an identity like a user or a service). This is the first step
6	before [Authorization](https://docs.cloud.google.com/iam/docs/overview)
7	(determining what you can do).
8
9	## Authentication
10
11	### Clarifying Questions for the Agent
12
13	Before providing a specific solution, clarify the following with the user:
14
15	1. Who or what is authenticating? (A human developer, a local script, or an
16	application running in production?)
17	2. Where is the code running? (Local laptop, [Compute
18	Engine](https://docs.cloud.google.com/compute/docs),
19	[GKE](https://docs.cloud.google.com/kubernetes-engine/docs), [Cloud
20	Run](https://docs.cloud.google.com/run/docs), or another cloud like
21	AWS/Azure?)
22	3. What is the target? (A Google Cloud API like Storage/BigQuery, or a
23	custom application you built?)
24	4. Are you using a high-level client library? (e.g., Python, Go, Node.js
25	libraries usually handle ADC automatically.)
26
27	---
28
29	## Human Authentication
30
31	For users to access Google Cloud, they need an identity that Google Cloud can
32	recognize.
33
34	### Types of User Identities
35
36	Google Cloud supports several ways to configure identities for your internal
37	workforce (developers, administrators, employees):
38
39	* **[Google-Managed
40	Accounts](https://docs.cloud.google.com/iam/docs/user-identities#google-accounts)**:
41	You can use Cloud Identity or Google Workspace to create managed user
42	accounts. These are called managed accounts because your organization
43	controls their lifecycle and configuration.
44	* **[Federation using Cloud Identity or Google
45	Workspace](https://docs.cloud.google.com/iam/docs/user-identities#synced-federation)**:
46	You can federate identities to allow users to use their existing identity
47	and credentials to sign in to Google services. Users authenticate against an
48	external identity provider (IdP), but you must keep accounts synchronized
49	into Google Cloud using tools like Google Cloud Directory Sync (GCDS) or an
50	external authoritative source like Active Directory or Microsoft Entra ID.
51	* **[Workforce Identity
52	Federation](https://docs.cloud.google.com/iam/docs/user-identities#workforce)**:
53	This lets you use an external IdP to authenticate and authorize a workforce
54	using IAM directly. Unlike standard federation, you do not need to
55	synchronize user identities from your existing IdP to Google Cloud
56	identities. It supports syncless, attribute-based single sign-on.
57
58	### Methods of Access for Developers and Administrators
59
60	Used for interacting with Google Cloud resources and APIs during development and
61	management.
62
63	* [Google Cloud Console](https://console.cloud.google.com/): The primary
64	web interface. You authenticate using your Google Account (Gmail or [Google
65	Workspace](https://workspace.google.com/)).
66	* **[gcloud CLI](https://docs.cloud.google.com/sdk/docs/install-sdk) (`gcloud
67	auth login`)**: Used to authenticate the CLI itself so you can run
68	management commands (e.g., `gcloud compute instances list`). It uses a
69	Credential (like an OAuth 2.0 refresh token) stored locally.
70	* **Local Development with [App Default Credentials
71	(ADC)](https://docs.cloud.google.com/docs/authentication/application-default-credentials)
72	(`gcloud auth application-default login`)**: This is different from CLI
73	auth. It creates a local JSON file that Google Cloud Client Libraries
74	(Python, Java, etc.) use to act as "you" when you run code on your laptop.
75	* **[Service Account
76	Impersonation](https://docs.cloud.google.com/docs/authentication/use-service-account-impersonation)**:
77	For security reasons, developers should avoid downloading Service Account
78	keys entirely. Instead, they should authenticate as humans (`gcloud auth
79	login`) and use Service Account Impersonation to run CLI commands or
80	generate short-lived credentials. This is a critical best practice for local
81	development and troubleshooting.
82
83	### For End-Users and Customers
84
85	Used when a human (who is not a developer) needs to access a web application
86	you've deployed on Google Cloud. Note: These are distinct from workforce
87	identities.
88
89	* [Identity-Aware Proxy (IAP)](https://docs.cloud.google.com/iap/docs):
90	Acts as a central authorization layer for web applications. It intercepts
91	web requests and verifies the user's identity (via Google Workspace, Cloud
92	Identity, or external providers) before letting them reach the application.
93	It's often used to protect internal apps withou

People who liked this also viewed

6 picks

Type

google-cloud-recipe-auth

32stars3forks

View on GitHub

How to install google-cloud-recipe-auth?

jmxt3/gitscape.ai/google-cloud-recipe-auth

$npx -y skills add jmxt3/gitscape.ai --skill google-cloud-recipe-auth

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Authenticating to Google Cloud
2
3	[Authentication](https://docs.cloud.google.com/docs/authentication) is the
4	process of proving who you are. In Google Cloud, you represent a
5	Principal (an identity like a user or a service). This is the first step
6	before [Authorization](https://docs.cloud.google.com/iam/docs/overview)
7	(determining what you can do).
8
9	## Authentication
10
11	### Clarifying Questions for the Agent
12
13	Before providing a specific solution, clarify the following with the user:
14
15	1. Who or what is authenticating? (A human developer, a local script, or an
16	application running in production?)
17	2. Where is the code running? (Local laptop, [Compute
18	Engine](https://docs.cloud.google.com/compute/docs),
19	[GKE](https://docs.cloud.google.com/kubernetes-engine/docs), [Cloud
20	Run](https://docs.cloud.google.com/run/docs), or another cloud like
21	AWS/Azure?)
22	3. What is the target? (A Google Cloud API like Storage/BigQuery, or a
23	custom application you built?)
24	4. Are you using a high-level client library? (e.g., Python, Go, Node.js
25	libraries usually handle ADC automatically.)
26
27	---
28
29	## Human Authentication
30
31	For users to access Google Cloud, they need an identity that Google Cloud can
32	recognize.
33
34	### Types of User Identities
35
36	Google Cloud supports several ways to configure identities for your internal
37	workforce (developers, administrators, employees):
38
39	* **[Google-Managed
40	Accounts](https://docs.cloud.google.com/iam/docs/user-identities#google-accounts)**:
41	You can use Cloud Identity or Google Workspace to create managed user
42	accounts. These are called managed accounts because your organization
43	controls their lifecycle and configuration.
44	* **[Federation using Cloud Identity or Google
45	Workspace](https://docs.cloud.google.com/iam/docs/user-identities#synced-federation)**:
46	You can federate identities to allow users to use their existing identity
47	and credentials to sign in to Google services. Users authenticate against an
48	external identity provider (IdP), but you must keep accounts synchronized
49	into Google Cloud using tools like Google Cloud Directory Sync (GCDS) or an
50	external authoritative source like Active Directory or Microsoft Entra ID.
51	* **[Workforce Identity
52	Federation](https://docs.cloud.google.com/iam/docs/user-identities#workforce)**:
53	This lets you use an external IdP to authenticate and authorize a workforce
54	using IAM directly. Unlike standard federation, you do not need to
55	synchronize user identities from your existing IdP to Google Cloud
56	identities. It supports syncless, attribute-based single sign-on.
57
58	### Methods of Access for Developers and Administrators
59
60	Used for interacting with Google Cloud resources and APIs during development and
61	management.
62
63	* [Google Cloud Console](https://console.cloud.google.com/): The primary
64	web interface. You authenticate using your Google Account (Gmail or [Google
65	Workspace](https://workspace.google.com/)).
66	* **[gcloud CLI](https://docs.cloud.google.com/sdk/docs/install-sdk) (`gcloud
67	auth login`)**: Used to authenticate the CLI itself so you can run
68	management commands (e.g., `gcloud compute instances list`). It uses a
69	Credential (like an OAuth 2.0 refresh token) stored locally.
70	* **Local Development with [App Default Credentials
71	(ADC)](https://docs.cloud.google.com/docs/authentication/application-default-credentials)
72	(`gcloud auth application-default login`)**: This is different from CLI
73	auth. It creates a local JSON file that Google Cloud Client Libraries
74	(Python, Java, etc.) use to act as "you" when you run code on your laptop.
75	* **[Service Account
76	Impersonation](https://docs.cloud.google.com/docs/authentication/use-service-account-impersonation)**:
77	For security reasons, developers should avoid downloading Service Account
78	keys entirely. Instead, they should authenticate as humans (`gcloud auth
79	login`) and use Service Account Impersonation to run CLI commands or
80	generate short-lived credentials. This is a critical best practice for local
81	development and troubleshooting.
82
83	### For End-Users and Customers
84
85	Used when a human (who is not a developer) needs to access a web application
86	you've deployed on Google Cloud. Note: These are distinct from workforce
87	identities.
88
89	* [Identity-Aware Proxy (IAP)](https://docs.cloud.google.com/iap/docs):
90	Acts as a central authorization layer for web applications. It intercepts
91	web requests and verifies the user's identity (via Google Workspace, Cloud
92	Identity, or external providers) before letting them reach the application.
93	It's often used to protect internal apps withou

People who liked this also viewed

6 picks

Type