google-cloud-recipe-auth Skill for Claude: Sign In to Google Cloud the Right Way

• Asks who authenticates, where code runs, what it calls

  Four questions come first: who or what is authenticating, where the code runs, what the target is, and whether a client library is in use.

  Clarifying questions

• Google-managed accounts, federation, gcloud login, ADC, impersonation

  Compares the ways a person gets in: Cloud Identity or Workspace accounts, federation, Workforce Identity Federation, the console, gcloud auth login and Application Default Credentials. It recommends impersonation over downloaded keys.

  Runs code · Human authentication

• Identity-Aware Proxy and Identity Platform

  Covers letting non-developer users into a web app you host: Identity-Aware Proxy for internal apps and Identity Platform for consumer sign-in.

  End-user authentication

• Service accounts, GKE, external workloads, keys, scopes

  Covers service accounts and service agents, attaching a service account, GKE, Workload Identity Federation for other clouds, API keys, access scopes and short-lived credentials.

  Service-to-service authentication

• Allow policies and predefined vs custom roles

  Explains binding a principal to a role on a resource and says to try predefined roles first.

  Authorization

• Local Python with ADC, Cloud Run to Cloud SQL, OIDC calls

  Three step lists: local Python development with ADC and a storage role, a Cloud Run service with a Cloud SQL client role, and calling a private Cloud Run service with an OIDC ID token.

  Worked examples

• Seven checks Claude runs through before it answers

  Discourage local service account keys, prefer a custom least-privilege service account in production, use Workload Identity Federation on other clouds, OIDC for custom apps, and restrict API keys.

  Validation checklist

• Tags gcloud commands and HTTP requests with the skill name

  Claude sets a CLOUDSDK_METRICS_REQUEST_ATTRIBUTION value on gcloud commands it runs in the terminal and appends a string to the User-Agent of direct HTTP calls. It is not added to generated scripts or Terraform.

  Runs code · Usage attribution (attribution.md)

Watch out for

• Commands run as your signed-in account

  If you let Claude run gcloud or REST calls while following the skill, they use your credentials. Approve commands one by one.

• Claude tags gcloud and HTTP calls with the skill name

  attribution.md says to set CLOUDSDK_METRICS_REQUEST_ATTRIBUTION on terminal gcloud commands and add a User-Agent suffix on direct HTTP calls. It says the tag carries no user data and that you can opt out by asking.