Using static Service Account (SA) keys in CI/CD pipelines has long been a common method for authenticating to Google Cloud Platform (GCP). However, storing long-lived credentials inside external pipeline environment variables introduces severe security vulnerabilities and ongoing operational friction.

Google Mandiant demonstrated in a threat intelligence blog post ( Holes in Your Bitbucket: Why Your CI/CD Pipeline Is Leaking Secrets ) that secret variables in Bitbucket pipelines can easily be extracted from environment variables during runtime. Moving away from static JSON keys toward Google Cloud Workload Identity Federation (WIF) provides a modern, keyless authentication mechanism that leverages OpenID Connect (OIDC) to exchange short-lived tokens, eliminating the risks associated with static credential management.

Why Service Account Keys Are a Bad Security Practice

While Atlassian Bitbucket documentation describes deployment to Google Cloud using Service Account keys , relying on traditional static…