@Provides
  GoogleCredentials getCredentials(@ProjectId String projectId) throws GoogleCredentialException {
    validateUsingGoogle(cloud);
    if (environment == Environment.LOCAL) { // Running locally
      // This is a crude check to make sure we are only pointing to test projects when running
      // locally and connecting to GCP
      Environment projectIdEnvironment = getProjectEnvironment(projectId);
      Preconditions.checkArgument(
          projectIdEnvironment == Environment.LOCAL
              || projectIdEnvironment == Environment.TEST
              || projectIdEnvironment == Environment.QA,
          "Invalid project to connect to with env=LOCAL. "
              + projectId
              + " doesn't appear to"
              + " be a local/test project since it doesn't end in -local, -test, or -qa.");
    } else { // Assume running on GCP
      // TODO: Check whether we are actually running on GCP once we find out how
      String credsLocation = System.getenv(GCP_CREDENTIALS_PATH_ENV_VAR);
      if (!credsLocation.startsWith(KUBERNETES_SECRETS_PATH_ROOT)) {
        String cause =
            String.format(
                "You are attempting to obtain credentials from somewhere "
                    + "other than Kubernetes secrets in prod. You may have accidentally copied "
                    + "creds into your image, which we provide as a local debugging mechanism "
                    + "only. See GCP build script (distributions/demo-google-deployment/bin/"
                    + "build_docker_image.sh) for more info. Creds location was: %s",
                credsLocation);
        throw new GoogleCredentialException(cause);
      }
      // Note: Tried an extra check via Kubernetes API to verify GOOGLE_APPLICATION_CREDENTIALS
      // is the same as the secret via Kubernetes, but this API did not seem reliable.
      // (io.kubernetes.client.apis.CoreV1Api.listSecretForAllNamespaces)
    }
    try {
      return GoogleCredentials.getApplicationDefault();
    } catch (IOException e) {
      throw new GoogleCredentialException(
          "Problem obtaining credentials via GoogleCredentials.getApplicationDefault()", e);
    }
  }
Return the {@link Environment} we are running in based on our convention of Project ID's ending
in "-" followed by lower-case environment name.

<p>Throws {@link IllegalArgumentException} if projectId does not have a valid environment
suffix.
extensions/cloud/portability-cloud-google/src/main/java/org/datatransferproject/cloud/google/GoogleCloudExtensionModule.java