Menyiapkan ADC untuk penyedia cloud lokal atau lainnya
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Jika menjalankan aplikasi di luar Google Cloud, Anda harus
memberikan kredensial yang dikenali oleh Google Cloud untuk
menggunakan layanan Google Cloud .
Workload Identity Federation
Cara yang lebih disukai untuk mengautentikasi dengan Google Cloud menggunakan kredensial dari
IdP eksternal adalah dengan menggunakan Workload Identity Federation;
Anda membuat file konfigurasi kredensial dan menetapkan
variabel lingkungan GOOGLE_APPLICATION_CREDENTIALS untuk menunjukkannya. Pendekatan
ini lebih aman daripada membuat kunci akun layanan.
Jika tidak dapat mengonfigurasi Workload Identity Federation, Anda harus
membuat akun layanan, memberinya peran IAM yang
diperlukan aplikasi, dan membuat kunci untuk akun layanan.
Untuk membuat kunci akun layanan dan menyediakannya bagi ADC:
Buat akun layanan dengan peran yang dibutuhkan aplikasi Anda, serta kunci
untuk akun layanan tersebut, dengan mengikuti petunjuk dalam
Membuat kunci akun layanan.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials.
This variable applies only to your current shell session, so if you open
a new session, set the variable again.
Example: Linux or macOS
exportGOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"
Replace KEY_PATH with the path of the JSON file that contains your credentials.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-25 UTC."],[[["\u003cp\u003eIf running applications outside of Google Cloud, you need to provide credentials recognized by Google Cloud to access its services.\u003c/p\u003e\n"],["\u003cp\u003eWorkload Identity Federation is the recommended method for authenticating with Google Cloud using external credentials, as it is more secure than service account keys.\u003c/p\u003e\n"],["\u003cp\u003eIf Workload Identity Federation is not feasible, service account keys can be used, but they pose a security risk and should be avoided if possible.\u003c/p\u003e\n"],["\u003cp\u003eTo use service account keys, create a service account with the necessary roles, generate a key, and set the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable to the key file's path.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable directs Application Default Credentials (ADC) to the specified credential location, and it takes precedence over other credential locations.\u003c/p\u003e\n"]]],[],null,["# Set up ADC for on-premises or another cloud provider\n\nIf you are running your application outside of Google Cloud, you need to\nprovide credentials that are recognized by Google Cloud to\nuse Google Cloud services.\n\n### Workload Identity Federation\n\nThe preferred way to authenticate with Google Cloud using credentials from\nan external IdP is to use [Workload Identity Federation](/iam/docs/workload-identity-federation);\nyou create a credential configuration file and set the\n`GOOGLE_APPLICATION_CREDENTIALS` environment variable to point to it. This\napproach is more secure than creating a service account key.\n\nFor help with setting up Workload Identity Federation for ADC, see\n[Workload Identity Federation with other clouds](/iam/docs/workload-identity-federation-with-other-clouds).\n\n### Service account key\n\nIf you are not able to configure Workload Identity Federation, then you must\ncreate a service account, grant it the IAM roles that\nyour application requires, and create a key for the service account.\n\n\n| **Note:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n|\n|\n| If you acquired the service account key from an external source, you must validate it before use.\n| For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n\nTo create a service account key and make it available to ADC:\n\n1. Create a service account with the roles your application needs, and a key for that service account, by following the instructions in [Creating a service account key](/iam/docs/keys-create-delete#creating).\n2.\n Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS`\n to the path of the JSON file that contains your credentials.\n This variable applies only to your current shell session, so if you open\n a new session, set the variable again.\n\n **Example:** Linux or macOS \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"\n ```\n **Example:** Windows\n\n For PowerShell: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"C:\\Users\\username\\Downloads\\service-account-file.json\"\n ```\n\n For command prompt: \n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n| **Note:** When you set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, ADC checks this location first, then checks other locations only if necessary.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n- Learn about [Workload Identity Federation](/iam/docs/workload-identity-federation).\n- Understand best practices for using [service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n- Explore [authentication methods](/docs/authentication)."]]
