How to add service account credentials to Google App Engine when debugging with IntelliJ IDEA?

user_16673 0
Viewed 2128

I am developing a Google App Engine (Standard environment) application which uses Google Cloud Storage. I have used App Engine APIs for Cloud Storage until now, which provides a local emulation for the Cloud Storage using Datastore. As those APIs are getting obsolete now, I have decided to use the recommended APIs, however I am struggling with the credentials when running on the Local Server (I am already using the new Cloud Code plugin, not the old App Engine one).

I have created a service account and I have created and downloaded the key for it. If I would be running a normal Java app, I would be able to specify enviroment variables for the VM and I could provide the necessary -DGOOGLE_APPLICATION_CREDENTIALS=xxxxx.json parameters. The server provided by the Cloud Code does not seem to have any way how to provide environment variables, I can only provide VM options, therefore I do not know how can I provide the necessary environment to it, or how to pass the credentials to it in some other way. The only way I got it kind of working was using

gcloud auth application-default login

which has saved credentials in D:\Users\xxxx\AppData\Roaming\gcloud\application_default_credentials.json. This works, but any time I am debugging my application, I get following warning:

com.google.auth.oauth2.DefaultCredentialsProvider warnAboutProblematicCredentials

WARNING: Your application has authenticated using end user credentials from Google Cloud SDK. We recommend that most server applications use service accounts instead. If your application continues to use end user credentials from Cloud SDK, you might receive a "quota exceeded" or "API not enabled" error.

I am not sure how serious this warning is, but it sure sounds scary to me.

In my application I use this code (Scala, Java would be very similar) to create the service with the credentials:

  val credentials = GoogleCredentials.getApplicationDefault
  val storage = StorageOptions.newBuilder().setCredentials(credentials).build().getService

What is the proper way to pass service account credentials when running on a local Google App Engine server?

google-cloud-iam google-cloud-platform google-app-engine java
1 Answers

The issue with the big warning is that Google does not want you to use User Credentials in place of Service Account credentials. Google is locking down (restricting) what scopes/data third-party services (you) can request. My advice is to not use User Credentials anymore as they will eventually no longer work.

There are several methods to solve this.

Method 1: Setup the CLI to use a service account:

gcloud auth activate-service-account test@development.iam.gserviceaccount.com --key-file=test_google_account.json

Use the correct email address for the service account. This can be found in the Google Cloud console and also in the JSON file. Google libraries will find these credentials. On my website, I have written several articles on the details of services accounts, Application Default Credentials (ADC), etc.

Method 2: Specify the service account in your code

credentials = GoogleCredentials.fromStream(new FileInputStream(service_account_filename))

Create a flag or environment variable so that your code can if-else decide when running on your desktop to process credentials.

Method 3:

If the system (not the VM command line) environment variable GOOGLE_APPLICATION_CREDENTIALS is set, the libraries will use the filename that the variable points to for service account credentials. This file is a Google Cloud Service Account credentials file in JSON format.

Set this environment variable before you launch your IntelliJ.

My Document Links:

user_80167200
Related