Using hvac login on GCP Cloud Function

Question

first question ever on StackOverflow.

I am trying to write a Cloud Function on gcp to login to vault via hvac. https://hvac.readthedocs.io/en/stable/usage/auth_methods/gcp.html#login

It says here that a path to a SA json but I am writing this on Cloud Function.

Does anyone have an example on how to do this properly? The default cloud identity SA associated with the function has permission already to the vault address.

Thanks

Answer 1

In Cloud Functions you don't need the path to the Service Account key because the Cloud Identity SA is already loaded as the Application Default Credentials (ADC).

The code from the link you share it's okay for environments where you don't have configured the ADC or simply you prefer to use another account.

For Functions, the code can be simpler:

import time
import json
import googleapiclient.discovery
import google.auth
import hvac

credentials, project = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])

now = int(time.time())
expires = now + 900
payload = {
    'iat': now,
    'exp': expires,
    'sub': credentials.service_account_email,
    'aud': 'vault/my-role'
}
body = {'payload': json.dumps(payload)}
name = f'projects/{project}/serviceAccounts/{credentials.service_account_email}'


iam = googleapiclient.discovery.build('iam', 'v1', credentials=credentials)
request = iam.projects().serviceAccounts().signJwt(name=name, body=body)
resp = request.execute()
jwt = resp['signedJwt']

client.auth.gcp.login(
    role='my-role',
    jwt=jwt,
)