Reviewed by Aditya Kumar · Last reviewed 2026-03-24
**Why Service Accounts (SA)**: Non-human identities for apps, VMs, Cloud Functions. No passwords to rotate; IAM-bound. **Architecture**: Create SA in IAM; assign roles (least privilege). Attach to VM, Cloud Run, Dataflow, Composer. For GKE/Cloud Run: use Workload...
This hard-level Cloud/Tools question appears frequently in data engineering interviews at companies like Verizon. While less common, it tests deeper understanding that distinguishes strong candidates.
This is a senior-level question that tests architectural thinking. Lead with the high-level design, then drill into specifics. Discuss trade-offs explicitly - there is rarely one correct answer. Show awareness of scale, fault tolerance, and operational complexity.
Why Service Accounts (SA): Non-human identities for apps, VMs, Cloud Functions. No passwords to rotate; IAM-bound. Architecture: Create SA in IAM; assign roles (least privilege). Attach to VM, Cloud Run, Dataflow, Composer. For GKE/Cloud Run: use Workload Identity—pod/container gets SA without key files. Workload Identity Federation extends to AWS/Azure for cross-cloud. Scalability: One SA per application/service; avoid shared SAs. Cost: No cost for SAs; key files are a liability—use Workload Identity. Security: Key files can leak; prefer ADC (Application Default Credentials) and Workload Identity. Best practice: One SA per app; least privilege; no key files in production—Workload Identity everywhere. Rotate keys if legacy apps require them.
Pro-Move: 'We use Workload Identity for all GKE workloads—zero key files in the org; we use Workload Identity Federation for CI/CD from GitHub.' Red Flag: Sharing one SA across multiple apps or storing key JSON in repos—major security anti-pattern.
Some links below are affiliate links. If you buy through them we may earn a small commission at no extra cost to you — it helps keep DataEngPrep free.
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.