Configurar o ADC para um local ou outro provedor de nuvem
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Se o aplicativo estiver sendo executado fora do Google Cloud, será necessário
fornecer credenciais reconhecidas pelo Google Cloud para
usar os serviços do Google Cloud .
Federação de identidade da carga de trabalho
A maneira mais comum de autenticar com Google Cloud usando credenciais de
um IdP externo é usar a federação de identidade da carga de trabalho;
você cria um arquivo de configuração de credenciais e define a
variável de ambiente GOOGLE_APPLICATION_CREDENTIALS para apontar para ele. Essa abordagem é mais segura do que criar uma chave de conta de serviço.
Se não for possível configurar a federação de identidade da carga de trabalho,
crie uma conta de serviço, conceda a ela os papéis do IAM
necessários ao aplicativo e crie uma chave para a conta de serviço.
Para criar uma chave de conta de serviço e disponibilizá-la para o ADC, faça o seguinte:
Crie uma conta de serviço com os papéis de que seu aplicativo precisa e uma chave para essa conta de serviço. Para fazer isso, siga as instruções em Como criar uma chave de conta de serviço.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials.
This variable applies only to your current shell session, so if you open
a new session, set the variable again.
Example: Linux or macOS
exportGOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"
Replace KEY_PATH with the path of the JSON file that contains your credentials.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-25 UTC."],[[["\u003cp\u003eIf running applications outside of Google Cloud, you need to provide credentials recognized by Google Cloud to access its services.\u003c/p\u003e\n"],["\u003cp\u003eWorkload Identity Federation is the recommended method for authenticating with Google Cloud using external credentials, as it is more secure than service account keys.\u003c/p\u003e\n"],["\u003cp\u003eIf Workload Identity Federation is not feasible, service account keys can be used, but they pose a security risk and should be avoided if possible.\u003c/p\u003e\n"],["\u003cp\u003eTo use service account keys, create a service account with the necessary roles, generate a key, and set the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable to the key file's path.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable directs Application Default Credentials (ADC) to the specified credential location, and it takes precedence over other credential locations.\u003c/p\u003e\n"]]],[],null,["# Set up ADC for on-premises or another cloud provider\n\nIf you are running your application outside of Google Cloud, you need to\nprovide credentials that are recognized by Google Cloud to\nuse Google Cloud services.\n\n### Workload Identity Federation\n\nThe preferred way to authenticate with Google Cloud using credentials from\nan external IdP is to use [Workload Identity Federation](/iam/docs/workload-identity-federation);\nyou create a credential configuration file and set the\n`GOOGLE_APPLICATION_CREDENTIALS` environment variable to point to it. This\napproach is more secure than creating a service account key.\n\nFor help with setting up Workload Identity Federation for ADC, see\n[Workload Identity Federation with other clouds](/iam/docs/workload-identity-federation-with-other-clouds).\n\n### Service account key\n\nIf you are not able to configure Workload Identity Federation, then you must\ncreate a service account, grant it the IAM roles that\nyour application requires, and create a key for the service account.\n\n\n| **Note:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n|\n|\n| If you acquired the service account key from an external source, you must validate it before use.\n| For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n\nTo create a service account key and make it available to ADC:\n\n1. Create a service account with the roles your application needs, and a key for that service account, by following the instructions in [Creating a service account key](/iam/docs/keys-create-delete#creating).\n2.\n Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS`\n to the path of the JSON file that contains your credentials.\n This variable applies only to your current shell session, so if you open\n a new session, set the variable again.\n\n **Example:** Linux or macOS \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"\n ```\n **Example:** Windows\n\n For PowerShell: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"C:\\Users\\username\\Downloads\\service-account-file.json\"\n ```\n\n For command prompt: \n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n| **Note:** When you set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, ADC checks this location first, then checks other locations only if necessary.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n- Learn about [Workload Identity Federation](/iam/docs/workload-identity-federation).\n- Understand best practices for using [service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n- Explore [authentication methods](/docs/authentication)."]]
