GCP Cloud Run Invoke another Projects Cloud function using short-lived credentials via 2 service accounts in separate Projects

user_7327713 0
Viewed 1266

I have done the below and it all works to the point of the last token being used to invoke a cloud function.

I have created a service account (SP), in Project 2, with Service-Account-Token-Creator and Cloud-Functions-Invoker roles. I also have created another service account (sc), in Project 1, with Service-Account-Token-Creator. I edited the IAM bindings of SP to allow SC the ability to create short-lived credentials via the Service-Account-Token-Creator role.

This code below, in Project 1, is running on CloudRun and with the service account, SC as the default service account for the instance.

Not sure what is really wrong, but all I'm trying to do is impersonate SP and then be able to invoke the cloud function in SP's account.

Any assistance with what is going wrong would help.

      import { Compute } from 'google-auth-library';

      const client = new Compute({
        // Specifying the service account email is optional.
        serviceAccountEmail:
          'sc@swaymeebusinessapp.iam.gserviceaccount.com',
      });

      const res = await client.request<{
        accessToken: string;
        expireTime: string;
      }>({
        url:
          'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/sp@<project-di>.iam.gserviceaccount.com:generateAccessToken',
        method: 'POST',
        data: JSON.stringify({
          delegates: [],
          scope: ['https://www.googleapis.com/auth/cloud-platform'],
          lifetime: '300s',
        }),
      });

      request.http.headers.set(
        'Authorization',
        `Bearer ${res.data.accessToken}`
      );

The error I received when invoking the cloud function in project 2 is

https://us-central1-project-2.cloudfunctions.net/project-2-alpha-TestFunction: 401: Unauthorized
google-cloud-iam google-cloud-run google-cloud-functions google-cloud-platform
2 Answers

You can simply grant the service account SC of the project1 on the Cloud Functions of the project2. SP is useless, impersonification also!

  • Get the email of SC
  • Go to your Cloud Functions list page and select your function (checkbox)
    • Click on "show info panel" in the upper right corner
    • Paste the SC email in the member section
    • Select Cloud Functions Invoker as role. enter image description here
  • save

That's all. You grant the SC of the project1, with the role Function.invoker at the level of the Cloud Functions of the project2

This definition is important. If you create another function, SC won't be able to reach it, because you grant the role only at the function level.

If you want to grant access to all the CLoud Function of the project2 (that is not recommended), you can do it like this

Instead of selecting your Cloud Functions in the project2, go to the IAM page of the project2 (here your are at project level) and click on Add Member (top of the page), paste the SC email and add the role CLoud FUnction invoker.

user_113725930
ptone_761990
Related