title: How can I grant a Cloud Run service access to service account's credentials without the key file?
body: <p>I'm developing a Cloud Run Service that accesses different Google APIs using a service account's secrets file with the following python 3 code:</p>
  <pre><code>from google.oauth2 import service_account
  credentials = service_account.Credentials.from_service_account_file(SECRETS_FILE_PATH, scopes=SCOPES)
  </code></pre>
  <p>In order to deploy it, I upload the secrets file during the build/deploy process (via <code>gcloud builds submit</code> and <code>gcloud run deploy</code> commands).</p>
  <p>How can I avoid uploading the secrets file like this?</p>
  <p><strong>Edit 1:</strong></p>
  <p>I think it is important to note that I need to impersonate user accounts from GSuite/Workspace (with domain wide delegation). The way I deal with this is by using the above credentials followed by:</p>
  <pre><code>delegated_credentials = credentials.with_subject(USER_EMAIL)
  </code></pre>