How to authenticate GSM with token in NodeJS

TheTanadu 0
Viewed 15

How to authenticate GSM with token in NodeJS? As far as I know there's option to auth using GOOGLE_APPLICATION_CREDENTIALS

import { SecretManagerServiceClient } from '@google-cloud/secret-manager';
const GClient = new SecretManagerServiceClient();

but is there option to authenticate otherwise? Like with some token we can retrieve from gcloud (gcloud auth print-identity-token [....])?

ok I got something, it use gcloud if GOOGLE_APPLICATION_CREDENTIALS isn't set. But I have problem that it use MAIN auth account, instead of impersonificated one (gcloud config set auth/impersonate_service_account [...]. How to set SecretManagerServiceClient to use impersonificated account?

google-secret-manager
1 Answers

ok, I found a solution for myself, but maybe someone will also go through this logic puzzle.

So the way to get around this problem is to give a user (or group of users) permission to Google secrets manager (for example, read-only). And this way your default gcloud user will work just fine. There may be some security issues, but with strict rules it can work just fine.

I wish I was able to use impersonation, but at least I solved my case.

TheTanadu0
Related