Google Cloud Function; Use Google Cloud Rest APIs

Question

The situation is that in my cloud function, I need to create VM instance from an instance template. I was using @google-cloud/compute package, but it doesn't provide a way to do so.

Now, I am trying to use the REST APIs, however I can't get it to authorize. I am using API keys, as instructed on this page Use api keys.

https://www.googleapis.com/compute/v1/projects/<ID>/zones/us-central1-a/instances?key=<API_KEY>&sourceInstanceTemplate=projects/<TEMPLATE_URL>

There is a post body as well, but that's irrelevant since the error is with the authorization.

I got login required error.

I do have a service account that I use with the cloud storage nodejs client on the same cloud function, but I couldn't find documentation on how I could use the same service account with the REST APIs on a cloud function.

Joan Grau Noël Joan Grau Noël · Accepted Answer · 2019-01-21T14:11:04

As per the documentation you linked, the usage of API keys are restricted to a limited number of API's:

A limited number of GCP services allow access using only an API key:

Google Cloud Natural Language API

Google Cloud Speech API

Google Cloud Translation API

Google Cloud Vision API

Google Cloud Endpoints

Google Cloud Billing Catalog API

Cloud Data Loss Prevention API

Hence it is not possible to use API keys to do REST calls to Compute Engine resources.

However, you have the option to use the Google APIs Node.js Client.

I did a small example on my side, that creates the Compute Engine instance from an instance template, in a Cloud Function running in Node.js 8 (in Node.js 6 you don't have the option of creating async calls, I believe, and you benefit from this calls since you don't have to wait for the instance to be created, in order to get a response from the CF):

index.js

const {google} = require('googleapis');
const compute = google.compute('v1');

exports.helloWorld = async data => {
  const authClient = await google.auth.getClient({
    scopes: [
      'https://www.googleapis.com/auth/cloud-platform',
      'https://www.googleapis.com/auth/compute',
    ],
  });
  const projectId = await google.auth.getProjectId();
  const result = await compute.instances.insert({
    auth: authClient,
    project: projectId,
    zone: "us-east1-c",
    sourceInstanceTemplate: "projects/YOUR_PROJECT_NAME/global/instanceTemplates/YOUR_TEMPLATE_NAME-template",
    resource: {
        name: "example-vm-from-api-call",
    },
  });
  console.log('done');
};

package.json

{
  "name": "sample-http",
  "version": "0.0.1",
  "dependencies": {
    "google-auth-library": "3.0.0",
    "googleapis-common": "0.6.0",
    "googleapis": "36.0.0"
  }
}

I have hard-coded the instance name to be always example-vm-from-api-call, but when doing requests to the cloud function, you can pass a name for the instance in the parameters, and use it to create the instance.

As well, note that the authentication is made by executing the line const authClient = await google.auth.getClient(...). This takes the application default authenticated account, which is the service account that executes the Cloud Function.

This service account has by default the permissions project/editor, which are enough to create CE VMs, however if you ever use another account to execute these functions, you will have to give it the correct access scopes (see the parameters of aforenamed function).

Google Cloud Function; Use Google Cloud Rest APIs

1 Answers