Blog

How to limit the lifetime of Google Cloud Platform SDK credentials

Mark van Holsteijn

Mark van Holsteijn

Updated January 27, 2026
1 minute
‌

Did you know that, once you have authenticated using the Google Cloud Platform SDK, the credential is valid for all eternity? With the Google Cloud session control tool you can limit the validity to as little as an hour.

After you type gcloud auth login , the credentials is stored under the directory ~/.config/gcloud. If this directory gets exfiltrated, the attacker can login using any of the accounts you ever logged in with.

To limit impact of such an event, navigate to Google Cloud session control, select the re-authentication option and choose the lifespan of the credentials. In the screenshot, I set the period to 1 hour. It drove my colleagues up the wall. Sorry.

Google Cloud session control screen

Image by anncapictures from Pixabay

Tags:

Written by

Mark van Holsteijn

Mark van Holsteijn is a senior software systems architect at Xebia Cloud-native solutions. He is passionate about removing waste in the software delivery process and keeping things clear and simple.

Our Ideas

Explore More Blogs

View All
‌
AWS ClientVPN SAML-based authentication via Tools4ever HelloID

AWS ClientVPN SAML-based authentication via Tools4ever HelloID

Extensive documentation exists for implementing SAML-based authentication for AWS Client VPN through IDPs like Okta and Azure AD, but if you or your...

Sander de Reus

‌
Infrastructure from Code: simplifying cloud deployments

Infrastructure from Code: simplifying cloud deployments

Over the years, I’ve worked with several infrastructure as code (IaC) tools, and one challenge stands out: the effort required to bridge the gap...

Xebia Author

‌
Kicking the tires of a European cloud provider – StackIT

Kicking the tires of a European cloud provider – StackIT

In this blog I will show you how you can get started on StackIT using open standard based tools like container images, Terraform and Kubernetes. You...

Mark van Holsteijn

‌
Fixing oversized artifacts AWS CDK Pipelines

Fixing oversized artifacts AWS CDK Pipelines

Joris Conijn

A

B

D

M

T

U

Y

Z

Contact

Let’s discuss how we can support your journey.

‌
‌
‌
‌
‌
‌
‌
‌
‌