CODEWITHSUNDEEP
google-cloud-platformgcloudgoogle-oauth
Prem Ramanathan
Prem Ramanathan

Reputation: 163

How to invoke gcloud with service account impersonation

I have a service running in GCE with default service account A. This service uses gcloud to talk to various GCP services. Currently, it uses service account B to talk to some of the GCP services (using private key). However, we want to get rid of using private key and use account impersonation. To do that, I have added account A to the service account B's role and given token creator role.

I wrote a test program in go and was able to verify the impersonation works. However, our service is in PHP, and uses gcloud SDK. I couldn't find a way to configure gcloud to impersonate a service account or provide custom token.

One option is that I rewrite all the gcloud code to use google SDK, but that is lots of work, and I'd rather avoid that. My question is, how do I invoke gcloud using service account B in this scenario?. Is there a way to pass access token to gcloud or specify impersonation user?

Upvotes: 13

Views: 37118

Answers (3)

Tiago Medici
Tiago Medici

Reputation: 2194

In my example running an app on Cloud Run, i had to set the audiences:

export TOKEN=$(gcloud auth print-identity-token --impersonate-service-account SERVICE_ACCOUNT_EMAIL --audiences='AUDIENCE')

curl -H "Authorization: Bearer ${TOKEN}" ENDPOINT

Upvotes: 2

David McWherter
David McWherter

Reputation: 129

gcloud has a --impersonate-service-account flag for this.

Upvotes: 11

Utkarsh Sharma
Utkarsh Sharma

Reputation: 625

  1. Run gcloud auth login and login using your gcp email address.
  2. Run export GOOGLE_OAUTH_ACCESS_TOKEN=$(gcloud auth print-access-token --impersonate-service-account=<sa-name>.iam.gserviceaccount.com) command to generate temporary credentials from the service account and store as the current OAUTH token. (this OAUTH token only lasts for 1 hour so make sure the operation using this token can complete within that time frame.

Upvotes: 9

Related Questions