如何將非默認 Google 服務帳戶憑據傳遞到Google Cloud Function 生產環境SecretManagerService或在其中傳遞？檔案在這里。SecretManagerServiceClient
在本地運行時，我可以使用from google.oauth2.service_account import Credentials然后credentials = Credentials.from_service_account_file("some-file.json")最后secret_client = SecretManagerServiceClient(credentials)但是在部署到 GCP 時，我不希望憑據檔案存盤為源代碼旁邊的 json/txt 檔案。
如果我為 App Engine 默認服務帳戶提供 Secret Accessor 角色并SecretManagerServiceClient()在不使用引數的情況下使用，則腳本可以訪問部署中的機密，但它是通過默認服務帳戶進行的。我想使用范圍有限的非默認帳戶 Secret Manager Secret Accessor 僅用于進一步的安全性。
我發現這是一個相關的答案，但對googleapis.dev的快速搜索卻一無所獲SecretManagerServiceClientBuilder。
uj5u.com熱心網友回復：
您必須在云功能中使用ADC（應用程式默認憑據）并且不提供服務帳戶密鑰檔案。
Indeed, the default service account of Cloud Functions is the App Engine default service account that is used. To use another service account, you can choose to change the cloud function identity and grand the secret accessor permission only to that service account
uj5u.com熱心網友回復：
I don't know all details of your case, but I am not sure it is to be done from inside the code.
If you know a service account under which the cloud function is executed, you might like to assign (at least) a Secret Manager Secret Accessor IAM role, so that your service account can read the required secret value.
If you prefer using console - it can be done from a page where permissions for a secret are listed and edited.
Ideally (from my point of view) it should be done within CICD pipeline, when your cloud function is being deployed together with all other relevant resources.
轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/429775.html