Access GCP services from on-prem python app keyless

[FalconSid]

Hi All,

good morning.

i am working on some solution based on best security approach. The use case is my application is copy the data to gcs using gsutil in current scenario I have kept service account key locally, but due to security reasons i have to removed that key.

any way we can connect gcp services like copy data to gcs bucket from on prem without storing services account json key  similar to application default login .?

any help much appropriated.

[hectorjacales]

I would recommend to take a look at service account impersonation[1]. In summary you use the service account on behalf of your user account, specific for gsutil you can follow this scheme when running commands:

gsutil -i [SERVICE-ACCOUNT]@[PROJECT] [GSUTIL-COMMAND]

gsutil -i myserviceaccount@iam.gserviceaccount.com cp file1 gs://sample/

Before running the command please make sure you hace the right permits mentioned in the documentation, this is a straight foward solution but  if for some reason this approach is not feasible you can dive more into Auth Tokens or explore gcsfuse as an option[2].

1- Use service account impersonation  |  Authentication  |  Google Cloud

2- Mount Cloud Storage buckets by using Cloud Storage FUSE  |  Google Cloud