How to assign multiple service account credentials to Google Cloud Functions?

2
votes

I have three service accounts:

  1. App engine default service account
  2. Datastore service account
  3. Alert Center API service account

My cloud functions uses Firestore in datastore mode for book keeping and invokes Alert Center API.

One can assign only one service account while deploying cloud functions.

Is there way similar to AWS where one can create multiple inline policies and assign it to default service account.

P.S. I tried creating custom service account but datastore roles are not supported. Also I do not want to store credentials in environment variables or upload credentials file with source code.

1
google-cloud-functionsgoogle-cloud-datastoreservice-accountsgoogle-alert-center-api

1 Answers

4
votes

You're looking at service accounts a bit backwards.

Granted, I see how the naming can lead you in this direction. "Service" in this case doesn't refer to the service being offered, but rather to the non-human entities (i.e. apps, machines, etc - called services in this case) trying to access that offered service. From Understanding service accounts:

A service account is a special type of Google account that belongs to your application or a virtual machine (VM), instead of to an individual end user. Your application assumes the identity of the service account to call Google APIs, so that the users aren't directly involved.

So you shouldn't be looking at service accounts from the offered service perspective - i.e. Datastore or Alert Center API, but rather from their "users" perspective - your CF in this case.

That single service account assigned to a particular CF is simply identifying that CF (as opposed to some other CF, app, machine, user, etc) when accessing a certain service.

If you want that CF to be able to access a certain Google service you need to give that CF's service account the proper role(s) and/or permissions to do that.

For accessing the Datastore you'd be looking at these Permissions and Roles. If the datastore that your CFs need to access is in the same GCP project the default CF service account - which is the same as the GAE app's one from that project - already has access to the Datastore (of course, if you're OK with using the default service account).

I didn't use the Alert Center API, but apparently it uses OAuth 2.0, so you probably should go through Service accounts.