query google groups api from gcp instance/function python

0
votes

I'm trying to create a script to query google groups API from GCP instance. The instance has SA attached to it, this SA has SCOPE - 'https://www.googleapis.com/auth/admin.directory.group.readonly' allowed in GSuite, and the user is also setup in GSuite with a custom role attached to it(list groups).

For the SA I created a key file in GCP console. Then I get the credentials as documentation says:

from googleapiclient.discovery import build
from google.oauth2 import service_account

creds = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)

then add the user - to act as.

creds = creds.with_subject('[email protected]')

service = build('admin', 'directory_v1', credentials=creds)

results = service.groups().list(domain=tenant, maxResults=10,
                    orderBy='email',
                    query='email:{}*'.format(group_name)).execute()

Then I query API, everything works perfect and I get the groups.

So my question is: Is there a way to use the SA attached to the instance without generating the json key file. Like get compute_instance / default credentials / from instance metadata and then somehow authenticate them to the GSuite API?

Or is there a way to query groups without hitting Gsuite API, just call some from within GCP?

2
pythongoogle-cloud-platformgoogle-workspaceservice-accounts

2 Answers

0
votes

You should read the next article on the official GCP Documentation page

Here is an example of how to bind service account to VM

gcloud compute instances create example-vm \
--service-account [email protected] \
--scopes https://www.googleapis.com/auth/admin.directory.group.readonly
0
votes

The answers I got from google:

  1. No, it's not possible without generating a private key for SA for impersonation.
  2. No, the right way of getting the groups is to query Gsuite's APIs.