Since serviceAccountTokenCreator enables service account impersonation and token minting, I’m curious about more least-privilege alternatives, such as -
-
Using the Custom Cloud Build service account identity directly
-
Relying on Cloud Run IAM invoker bindings (in case of cloud run invocation from cloud buuld
-
Avoiding explicit token creation unless absolutely required
When is iam.serviceAccountTokenCreator truly required?