How to use the google services like bucket or pub sub without service key.json file in development environment?

Question

For using the google pub sub we need key.json file which serves as service account.

For deployed code we can pass the service_account: name@service-name.iam.gserviceaccount.com in app.yaml which works if everything is in google cloud.

As it is not recommend to download the service account file.

Is there a way where we can just pass the key name in local environment file along with individual credential who has access to service account in run time or any other way where we can run google cloud services in local enviornment without downloading the service key file?

Answer 1

Google makes this really hard to find, but gcloud auth application-default login might do what you need.

From that page:

Obtains user access credentials via a web flow and puts them in the well-known location for Application Default Credentials (ADC).

This command is useful when you are developing code that would normally use a service account but need to run the code in a local development environment where it's easier to provide user credentials. The credentials will apply to all API calls that make use of the Application Default Credentials client library. Do not set the GOOGLE_APPLICATION_CREDENTIALS environment variable if you want to use the credentials generated by this command in your local development. This command tries to find a quota project from gcloud's context and write it to ADC so that Google client libraries can use it for billing and quota. Alternatively, you can use the --client-id-file flag. In this case, the project owning the client ID will be used for billing and quota. You can create the client ID file at https://console.cloud.google.com/apis/credentials.