Search code examples
google-cloud-platformgcloudgoogle-iam

Can I automate `gcloud auth login`?


I am unable to non-interactively activate my Google Cloud service account; even after reading several SO threads.

  1. Creating a service account

gcloud iam service-accounts create my-awesome-acct ...

  1. Creating a role for the service account

gcloud iam roles create AwesomeRole \ --permissions storage.objects.create,storage.objects.delete ....

  1. Generating the keys

gcloud iam service-accounts keys create ~/awesome-key.json ...

  1. Activating the service account

gcloud auth activate-service-account my-awesome-acct ~/awesome-key.json

My Issue

Even after following the above steps, when I run gsutil ... commands, I still get the error message:

$ gsutil cp my_file.tgz gs://my_bucket

  Copying file://my_file.tgz [Content-Type=application/x-tar]...
  Your credentials are invalid. Please run

  $ gcloud auth login

The only way I could get this to work is to actually run gcloud auth login and allow the authentication in a web browser.

Am I doing something wrong? Or is this intended for every service account?


Solution

  • I'm going to answer my own question here.

    My Solution

    Instead of using gsutil, I decided to use the Google Cloud Client Libraries.

    What I did:

    gsutil cp my_file.tgz gs://my_bucket
    

    What I am doing now:

    from gcloud import storage
    
    # key file is located in my current directory
    os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', 'gcloud-auth.json')
    
    client = storage.Client()
    bucket = client.get_bucket("my_bucket")
    blob = bucket.blob("my_file.tgz")
    blob.upload_from_filename("my_file.tgz")
    

    Hindsight 20/20

    After getting the above solution working, it seems if I also set the environment variable, GOOGLE_APPLICATION_CREDENTIALS, my gsutil should've worked too. (untested)