{"id":30061,"date":"2022-05-17T16:01:23","date_gmt":"2022-05-17T16:01:23","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=30061"},"modified":"2022-12-23T05:52:55","modified_gmt":"2022-12-23T05:52:55","slug":"google-cloud-platform-authentication-method-with-terraform","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/google-cloud-platform-authentication-method-with-terraform\/","title":{"rendered":"Google cloud Platform Authentication Method with Terraform"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Method 1 &#8211; User Application Default Credentials (&#8220;ADCs&#8221;)<\/h2>\n\n\n\n<p>Application Default Credentials (ADC) provide a method to get credentials used in calling Google APIs. The gcloud auth application-default command group allows you to manage active credentials on your machine that are used for local application development.<br>These credentials are only used by Google client libraries in your own application.<\/p>\n\n\n\n<p>To use your own user credentials for your application to access an API, run: This will take you through a web flow to acquire new user credentials.<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">$ gcloud auth application-<span class=\"hljs-keyword\">default<\/span> login\r\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Method 2 &#8211; Running Terraform on Google Cloud<\/h2>\n\n\n\n<p>If you are running Terraform in a machine on Google Cloud, you can configure that instance or cluster to use a Google Service Account. This allows Terraform to authenticate to Google Cloud without a separate credential\/authentication file. Ensure that the scope of the VM\/Cluster is set to or includes https:\/\/www.googleapis.com\/auth\/cloud-platform.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Method &#8211; 3 &#8211; Running Terraform Outside of Google Cloud &#8211; OIDC based federation<\/h2>\n\n\n\n<p>If you are running Terraform outside of Google Cloud, generate an external credential configuration file (example for OIDC based federation) or a service account key file and set the &#8220;GOOGLE_APPLICATION_CREDENTIALS&#8221; environment variable to the path of the JSON file. Terraform will use that file for authentication. Terraform supports the full range of authentication options documented for Google Cloud.<\/p>\n\n\n\n<p>To create a service account and have your application use it for API access, run:<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">$ gcloud iam service-accounts create my-account\r\n$ gcloud iam service-accounts keys create key.json --iam-account=my-account@my-project.iam.gserviceaccount.com\r\n$ export GOOGLE_APPLICATION_CREDENTIALS=key.json\r\n<span class=\"hljs-comment\"># Remove the newline characters from your JSON key file and then paste the credentials into the environment variable value field. You can use the tr command to strip newline characters. <\/span>\r\n$ cat key.json | tr -s <span class=\"hljs-string\">'\\n'<\/span> <span class=\"hljs-string\">' '<\/span>\r\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Useful COMMANDS<\/h2>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\"><span class=\"hljs-comment\"># Acquire new user credentials to use for Application Default Credentials.<\/span>\r\ngcloud auth application-<span class=\"hljs-keyword\">default<\/span> login\r\n\r\n<span class=\"hljs-comment\"># Print an access token for your current Application Default Credentials.<\/span>\r\n$ gcloud auth <span class=\"hljs-keyword\">print<\/span>-access-token\r\n\r\n<span class=\"hljs-comment\"># Revoke previously generated Application Default Credentials.<\/span>\r\n$ gcloud auth revoke\r\n\r\n<span class=\"hljs-comment\"># Update or add a quota project in application default credentials (ADC).<\/span>\r\n$ gcloud auth set-quota-project<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator\"\/>\n","protected":false},"excerpt":{"rendered":"<p>Method 1 &#8211; User Application Default Credentials (&#8220;ADCs&#8221;) Application Default Credentials (ADC) provide a method to get credentials used in calling Google APIs. The gcloud auth application-default&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-30061","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/30061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=30061"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/30061\/revisions"}],"predecessor-version":[{"id":30064,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/30061\/revisions\/30064"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=30061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=30061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=30061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}