-
Notifications
You must be signed in to change notification settings - Fork 273
Add Support for IAMCredentials based impersonation #210
Copy link
Copy link
Closed
Labels
type: feature request‘Nice-to-have’ improvement, new feature or different behavior or design.‘Nice-to-have’ improvement, new feature or different behavior or design.
Description
Feature request to support service account impersonation provided by
iamcredentials.generateAccessToken()
This will allow one set of credentials to assume another set for use in the coud libraries:
sample usage:
String cred_env = "/path/to/svc_account.json";
ServiceAccountCredentials source_credentials = ServiceAccountCredentials
.fromStream(new FileInputStream(cred_env));
source_credentials = (ServiceAccountCredentials) source_credentials
.createScoped(Arrays.asList("https://www.googleapis.com/auth/iam"));
ImpersonatedCredentials target_credentials = ImpersonatedCredentials.create(
source_credentials,
"impersonated-account@fabled-ray-104117.iam.gserviceaccount.com",
null,
Arrays.asList("https://www.googleapis.com/auth/devstorage.read_only"), 3600);
Storage storage_service = StorageOptions.newBuilder().setProjectId("project-id")
.setCredentials(target_credentials).build().getService();
for (Bucket b : storage_service.list().iterateAll())
System.out.println(b);ref:
- https://cloud.google.com/iam/credentials/reference/rest/v1/projects.serviceAccounts/generateAccessToken
- https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials
in python: googleapis/google-auth-library-python#299
in golang: golang/oauth2#335
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
type: feature request‘Nice-to-have’ improvement, new feature or different behavior or design.‘Nice-to-have’ improvement, new feature or different behavior or design.