On-premises infrastructure must upload user profiles to Datastore during migration while GCE VMs run the application. Which service-account key strategy do you recommend?

For on-premises infrastructure, service account keys are necessary for authentication with Google Cloud services like Datastore, as there's no built-in identity provider. For GCE VMs, using GCP-managed keys (via the default service account or a custom one assigned to the VM) is the recommended and most secure approach. This leverages Google's secure metadata service for automatic credential rotation and management, avoiding the need to store keys directly on the VM. Authenticating on-premises with a user account is less secure and harder to manage at scale. Deploying a custom authentication service adds unnecessary complexity.