I have successfully deployed apollo-server-express on a GAE instance, however, the instance is unable to fetch secrets from the Google Secrets Manager.
Error from GAE Logs:
Error: 7 PERMISSION_DENIED: The caller does not have permission
index.ts
// @note `SECRET_NAMES` is a comma separated string of the secrets' paths
const secretNames = process.env.SECRET_NAMES?.split(',') ?? []
for (const secretName of secretNames) {
// @note `loadSecret` will use Google Secrets Manager SDK to download the payload
// @note `secretName` is the fully qualified path to the secret located in Google Secret Manager API
Object.assign(process.env, await loadSecret(secretName))
}
app.yml
runtime: nodejs16
service: <service-name>
instance_class: F1
env_variables:
SECRET_NAMES: '<path-1>/versions/latest,<path-2>/versions/latest`
On my local machine, I would use the google-service-key.json to have the server run with an app service's credentials as default. This app service has the following roles:
- Secrets Access
- SQL Client
However, once I run gcloud app deploy, the server is no longer going to look for the google-service-key.json, and instead will use admin.credentials.applicatioDefault() to authenticate.
However, I'm not certain that the default credentials of the GAE instance are the same credentials that I referenced in the google-service-key.json.