In Google Cloud, the stronger path is clear: replace long-lived JSON keys in GitHub Actions, GitLab, and Terraform with Workload Identity Federation, short-lived tokens, and tightly scoped impersonation. Fewer secrets, smaller blast radius, better control.
