An API I was building required a query of a datastore and to avoid getting a 500 error, I needed to add the service account as a viewer to the datastore. While I don't particularly care about access to the entity that is getting queried, there are other entities within the datastore that I would rather not have potential external access. My question is, is there a danger of accessing other entities within a datastore through that service account somehow? Would it be safer to create a separate datastore for the service account that only contains the entity that it needs to access? Or would it not make a difference either way and I'm just being paranoid?
Discussion posts and replies are publicly visible
I don't see what feasible risk this would represent if the service account has viewership access to the general data store - it's still being given access to the specific API you're building and that API is still only querying the specific thing you're telling it to query. It's not like it enables that user to log in (at all) and even if it was a user that could log in, it's not as if they would have access to browse the data store or launch arbitrary queries.
That was more or less my thinking, but I thought I'd ask anyway as it is better to be safe than sorry.