All Bridges/GCP to AWS Data Engineering Bridge/Service Accounts, IAM & Local App Access

GCP ➔ AWS Deep Dive

•Service Accounts, IAM & Local App Access

GCP Service Accounts & Cloud IAM ➔ AWS IAM (Users, Access Keys & Roles)

From GCP Service Accounts & JSON Keys to AWS IAM Users, Access Keys, Roles & Boto3 Credential Chains.

The 30-Second Mental Model Shift

In GCP, you create a 'Service Account' and download a JSON key file. In AWS, you create an 'IAM User' and generate an 'Access Key ID & Secret Access Key' (or assume an IAM Role). In Python, Boto3 automatically checks environment variables and local `~/.aws/credentials` with the exact same convenience as Google's ADC!

1. Architectural Mechanism Comparison

GCP (What You Know)

Source

GCP Service Accounts & Cloud IAM

Service Accounts (`app@project.iam.gserviceaccount.com`) authenticated via downloaded JSON key files or Application Default Credentials (ADC). Roles assigned via IAM Policy Bindings.

Key Architecture Strengths:

Uniform identity model across local machines, VMs, and Cloud Run.
Application Default Credentials (ADC) automatically resolves local credentials.
GKE Workload Identity for keyless Kubernetes authentication.

AWS (How It Works)

Mastery Target

AWS IAM (Users, Access Keys & Roles)

Programmatic IAM Users authenticated via Access Key ID + Secret Access Key, or IAM Roles assumed via AWS STS (Security Token Service). Local development configured via `aws configure` in `~/.aws/credentials`. Permissions defined in JSON IAM Policies.

Why AWS Built It This Way:

Universal `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables across all tools and SDKs.
IAM Roles for EC2 / EKS (IRSA) for 100% keyless in-cloud token generation.
AWS Secrets Manager with automated database password rotation.

2. Interactive Terminology & Concept Bridge

Interactive Concept Bridge: Terminology & Architectural Mapping

Click any concept below to see how your GCP knowledge directly maps into AWS.

Mapping Deep Dive

Exact Concept Match

⚡ Direct cognitive shortcut

GCP (What You Know)

GCP Service Account (GSA)

`app-bq@project.iam.gserviceaccount.com` for application identity.

AWS (How It Works)

AWS IAM User (Programmatic) or IAM Role

Identity in AWS IAM representing a machine or application.

The Architectural Mental Shortcut:

Both represent non-human machine identities used by automation scripts.

3. Visual Architecture Pipeline (AWS IAM (Users, Access Keys & Roles))

IAM Mental Model: Policy = Principal (“Who”) + Role (“What”) + Resource (“Where”)

Click any section below or run the simulation to see how Google Cloud evaluates IAM policy bindings.

1. Principal (“Who”)

Bind

2. Role (“What”)

Apply

3. Resource (“Where”)

💡 Analogy: Like a job title or access pass (e.g. 'Warehouse Inspector Pass') that lists exactly which doors you are permitted to open.

Authorization

Component Inspector

2. The Role ('WHAT' they can do)

Predefined & Custom Roles (Collections of Exact Permissions)

A Role is a collection of fine-grained permissions (e.g. `storage.objects.get`, `bigquery.jobs.create`). Predefined roles are curated by Google, while Custom roles provide surgical least-privilege control.

Under the Hood:

•Predefined roles (e.g. `roles/bigquery.dataViewer`) maintained and updated automatically by Google.
•Custom roles let you bundle exact permissions to enforce strict least-privilege compliance.
•Primitive roles (`Owner`, `Editor`, `Viewer`) are legacy anti-patterns to avoid in production.

Key Benchmark Metrics:

Role Types

Predefined & Custom

Least-privilege

Primitive Roles

Avoid in Prod

Overly broad

4. Side-by-Side Code, CLI & Terraform Translator

Side-by-Side Code & Syntax Translator

GCP Syntax

# ========================================================
# GCP: Local Python Script (BigQuery & GCS)
# ========================================================
import os
from google.cloud import bigquery

# Option A: Explicit Service Account JSON Key
# os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = "/path/to/sa_key.json"

# Option B: Run 'gcloud auth application-default login' once on your machine!
client = bigquery.Client(project="my-gcp-project")

query = "SELECT region, SUM(amount) AS total FROM `my-gcp-project.analytics.orders` GROUP BY region"
for row in client.query(query).result():
    print(f"Region: {row.region}, Total: {row.total}")

AWS Equivalent

# ========================================================
# AWS: Local Python Script (Amazon S3 & Athena)
# ========================================================
import os
import boto3

# Option A: Explicit Access Key Environment Variables
# os.environ["AWS_ACCESS_KEY_ID"] = "AKIAIOSFODNN7EXAMPLE"
# os.environ["AWS_SECRET_ACCESS_KEY"] = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

# Option B: Run 'aws configure' once on your machine!
# Boto3 automatically reads ~/.aws/credentials
s3 = boto3.client('s3', region_name='us-east-1')

response = s3.list_objects_v2(Bucket='my-aws-lake-bucket', Prefix='orders/2026')
for obj in response.get('Contents', []):
    print(f"Found S3 Object: {obj['Key']}, Size: {obj['Size']} bytes")

Code Translation Notes:Both SDKs feature automatic credential discovery chains. Running `gcloud auth application-default login` in GCP or `aws configure` in AWS sets up your local machine for zero-key coding!

5. Paradigm Shift Gotchas: Traps to Avoid in AWS

Gotcha #1

high

Root Account Access Key Vulnerability

The Trap:

New AWS developers often create Access Keys on their root account. If committed to a public GitHub repo, attackers can spin up thousands of EC2 crypto-miners in minutes!

How to Avoid It:

Always lock the AWS Root Account behind MFA, and create dedicated IAM Users with least-privilege permissions.

Gotcha #2

medium

Access Key Rotation Requirement

The Trap:

Unlike temporary IAM Role session tokens, static access keys live forever until deleted or deactivated.

How to Avoid It:

Use AWS IAM Roles with STS assume role for production, or rotate static access keys regularly using AWS CLI.

6. Test Your Mental Model

Quick Knowledge Check: Test Your AWS Mental Model

Solidify your cross-cloud understanding with instant feedback.

1How does the Python AWS SDK (Boto3) discover credentials on a developer's local machine without hardcoding keys in code?

2What is the AWS equivalent of GKE Workload Identity for granting keyless IAM permissions to Kubernetes pods?

Back to GCP to AWS Data Engineering Bridge Open Full AWS IAM (Users, Access Keys & Roles) Guide