Authenticate Google Cloud vision without using environment variables (set credentials by code)

Question

I am trying to connect to Google Cloud Vision from an AWS lambda function, the only way to authenticate seems to be by setting a certain environment variable, is there a way to authenticate using code (I am planning to store credentials details in AWS Secrets Manager and passing them through to the Google Vision client in Python).

The constructor of vision.ImageAnnotatorClient takes Credentials as the first parameter, but frustratingly, I am not able to construct such an object for a set of service account credentials!

Hope someone can help!

EDIT In this link, it seems that languages other than Python, there is something to help with parsing credentials, but not with the Python example!

https://cloud.google.com/docs/authentication/production#auth-cloud-explicit-python

Answer 1

Was not an easy find :( Here is the code to do that:

service_account_info_string = R"""{
    "type": "service_account",
    "project_id": "",
    "private_key_id": "",
    "private_key": "-----BEGIN PRIVATE KEY-----\n.......\n-----END PRIVATE KEY-----\n",
    "client_email": "....@.....iam.gserviceaccount.com",
    "client_id": "545................45648",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/....%40....iam.gserviceaccount.com"
    }
    """

service_account_info_json = json.loads(service_account_info_string)

service_account_creds = creds.from_service_account_info(service_account_info_json)

client = vision.ImageAnnotatorClient(credentials=service_account_creds)