go - 为 Go : unknown credential type: "impersonated_service_account"? 使用 Google 云客户端库时出错

Question

我正在使用 Go 中的 Google Cloud 并关注 John Hanley 的这篇文章:

https://www.jhanley.com/google-cloud-improving-security-with-impersonation/

并用这个 SO 答案将其捣碎:

How to authenticate Google APIs (Google Drive API) from Google Compute Engine and locally without downloading Service Account credentials?

凭据已成功保存到“application_default_credentials.json”:

注意:“type”:“impersonated_service_account”

    {
  "delegates": [],
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[sa@example-2021.iam.gserviceaccount.com]:generateAccessToken",
  "source_credentials": {
    "client_id": "...apps.googleusercontent.com",
    "client_secret": "...",
    "refresh_token": "...",
    "type": "authorized_user"
  },
  "type": "impersonated_service_account"
}

我的代码生成了一个未知的凭证类型:“impersonated_service_account”错误:

package main

import (
...
    "cloud.google.com/go/storage"
    "golang.org/x/oauth2"
    "google.golang.org/api/docs/v1"
    "google.golang.org/api/drive/v3"
    "google.golang.org/api/impersonate"
    "google.golang.org/api/option"
...
)

var Config.GoogleServiceAccount string = "sa@example-2021.iam.gserviceaccount.com"




func main(){
  _ = getTokenAsImpersonator()
}

// From: https://pkg.go.dev/google.golang.org/api/impersonate#example-CredentialsTokenSource-ServiceAccount
func getTokenAsImpersonator() oauth2.TokenSource {
    ctx := context.Background()

    // Base credentials sourced from ADC or provided client options.
    ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
        TargetPrincipal: Config.GoogleServiceAccount,
        Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
        // Delegates: []string{"bar@project-id.iam.gserviceaccount.com"},
    })
    if err != nil {
        log.Fatal(err)
    }

    return ts
}

“未知凭证类型:“impersonated_service_account””错误:

google: error getting credentials using GOOGLE_APPLICATION_CREDENTIALS environment variable: unknown credential type: "impersonated_service_account"

我做错了什么还是这是一个错误？

---

更新

从评论中回答 John 的问题:

1.

a) 环境变量 GOOGLE_APPLICATION_CREDENTIALS 的值是多少？

GOOGLE_APPLICATION_CREDENTIALS=/Users/x/.config/gcloud/application_default_credentials.json

b) 您使用什么命令生成 application_default_credentials.json？

gcloud auth application-default login --scopes=https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/accounts.reauth,openid --impersonate-service-account=[sa@example-2021.iam.gserviceaccount.com]


Response:

Credentials saved to file: [/Users/x/.config/gcloud/application_default_credentials.json]

c)哪个操作系统和版本？

MacOS 10.13.6

d)gcloud --version?

Google Cloud SDK 343.0.0
app-engine-go 
app-engine-python 1.9.91
bq 2.0.69
cloud-datastore-emulator 2.1.0
core 2021.05.27
gsutil 4.62

1. 如果你能创建一个最小的例子......

我已经更新了上面的示例代码。

Answer 1

在某些时候，我曾使用 CLI 来模拟一个帐户:

gcloud config set auth/impersonate_service_account <service account>

稍后，当尝试使用应用程序默认凭据命令时，它会将您的凭据与服务帐户凭据包装在一起。

gcloud auth application-default login

您最终得到的文件如下所示:

{
  "delegates": [],
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/example@example-project.iam.gserviceaccount.com:generateAccessToken",
  "source_credentials": {
    "client_id": "123abc.apps.googleusercontent.com",
    "client_secret": "XXXXXXXXX",
    "refresh_token": "XXXXXXXXX",
    "type": "authorized_user"
  },
  "type": "impersonated_service_account"
}

这似乎会给 Terraform 等第三方服务带来很多问题。

What is strange is that Terraform is just making API calls to Google using Google SDKs, so really its something to do with Google.

您需要删除模拟:

gcloud config unset auth/impersonate_service_account

然后再次运行应用程序默认凭证命令:

gcloud auth application-default login

现在，如果您检查文件，它应该如下所示:

{
  "client_id": "XXXXXXXXX",
  "client_secret": "XXXXXXXXX",
  "quota_project_id": "example-project",
  "refresh_token": "XXXXXXXXXX",
  "type": "authorized_user"
}

当我尝试模拟一个帐户以便我可以将 Terraform 命令作为服务帐户而不是我的个人帐户运行时，我遇到了同样的问题，但它不喜欢那样。

编辑:重读你的问题听起来你和我在同一条船上。我们希望在不实际下载 key 的情况下使用服务帐户。这甚至被谷歌称为最佳实践。但这样做会导致他们自己的 SDK 出现问题。