Give a Gmail-API outside our google cloud Pub/Sub publisher privileges

0
votes

Let me try to explain to you what we are trying to do.

Saying it quickly: We want to give Pub/Sub Publisher (in our GoogleCloud) privileges to a GMail-API that is outside of our GoogleCloud.

What we have: Following instructions here: https://developers.google.com/gmail/api/quickstart/ruby We've created a project for GMail-API and the credentials in GoogleCloud, let's call it Cloud-A. (We'll not own this side in a production environment; this project and cloud will be managed by our customers' IT department.)

Next, we followed this other guide https://developers.google.com/gmail/api/guides/push We created a Pub/Sub topic in our GoogleCloud (Cloud-B), we own this portion and it's the topic where we want to subscribe in order to listen for messages/notifications. (This topic is in a different account from the GMail-API that will be publishing messages that is Cloud-A). So, following that last guide, it says that we need to give permissions to [email protected] and from my understanding what that means is that I'm giving privileges to GMail-API from Cloud-B to publish messages in Pub/Sub Cloud-B.

What I can't find out is a way to give permissions to Gmail-API from Cloud-A to publish messages in Pub/Sub Cloud-B.

To wrap up, I want to listen to Pub/Sub in Cloud-B that will receive notifications from Gmail-API in Cloud-A.

We used this https://github.com/googleapis/google-api-ruby-client/blob/master/generated/google/apis/gmail_v1/service.rb#L144 and I get an error saying that the topic doesn't exist (Probably because it is in Cloud-B and I'm configuring Cloud-A Gmail-Api)

I hope I was clear enough, we are not looking to given another project inside the same Google Cloud access to a Pub/Sub, it isn't even a service that we wrote since it is Gmail-Api and the only thing we are allowed to do is to send it the topic name we want it to publish in.

1
google-cloud-platformgmailgoogle-cloud-pubsub

1 Answers

0
votes

I'm not familiar with how the GMail-API publishes to Pub/Sub, but, if you have already figured out how to publish from GMail-API in project Cloud-A to a Pub/Sub topic in Cloud-A, you may try the following workarounds:

Alternative A:

  1. Create the topic (topic-A) in project Cloud-A.
  2. Create a pull subscription (subs-A) associated to topic-A also in project Cloud-A.
  3. Create a service account (account-B) in project Cloud-B and grant it the Pub/Sub subscriber role for subscription subs-A.
  4. Make your consumers (e.g. AppEngine, GKE, GCE) use service account account-B to pull messages from subs-A.

Alternative B:

  1. Create the topic (topic-A) in project Cloud-A.
  2. Create a push subscription (subs-A) associated to topic-A pointing to an endpoint of a service hosted in project Cloud-B (e.g. GCE, GKE, AppEngine, Cloud Function, etc.)

Alternative C:

  1. Create the topic (topic-A) in project Cloud-A.
  2. Create a pull or push subscription (subs-B) in project Cloud-B associated to topic-A in project Cloud-A. The user creating this subscription should have the Pub/Sub Editor role granted for topic-A.
  3. Consume the messages from subs-B.