CODEWITHSUNDEEP
gogoogle-cloud-platformoauthimpersonation
Clark McCauley
Clark McCauley

Reputation: 1457

Go GCP Impersonate two service accounts at the same time

I have two different GCP projects and am trying to clone a persistent disk from one project to the other. I have a service account in each project, and I need to create an impersonation token that will allow me to read the persistent disk from one project, and create a new persistent disk resource in the other project.

The problem is that impersonating one or the other service accounts to create the persistent disk does not work because a single API call needs to read the disk from Project A and create a new disk in Project B. In other words, I need to make an API call using a single impersonated token that has permissions to both. How can I do this with the Go API client?

Here is my impersonation code as it stands today

func Impersonate(ctx context.Context, principle string, credentials []byte) (*oauth2.Token, error) {​​​​
   source, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{​​​​
      TargetPrincipal: principle,
      Scopes:          []string{​​​​"https://www.googleapis.com/auth/compute", "https://www.googleapis.com/auth/cloud-platform"}​​​​,
   }​​​​, option.WithCredentialsJSON(credentials))
   if err != nil {​​​​
      return nil, fmt.Errorf("creating impersonated token source: %w", err)
   }​​​​
   return source.Token()
}​​​​

Upvotes: 3

Views: 1007

Answers (1)

John Hanley
John Hanley

Reputation: 81336

You can only impersonate one identity at a time. The correct method is to use a service account that has permissions in both projects.

Upvotes: 1

Related Questions