GCP-如何在没有密钥文件的情况下运行Python应用程序作为服务帐户
gcloud和gsutil具有- 模仿service-account，我们可以假冒服务帐户。
对于Python程序，是否有一种方法可以将程序作为服务帐户运行，而无需使用Service帐户秘密密钥文件作为密钥文件，而不是出于安全原因。
服务帐户密钥可能会造成安全风险。我们建议您避免下载服务帐户键
gcloud and gsutil have --impersonate-service-account by which we can impersonate a service account.
For Python program, is there a way to run the program as a service account without using the service account secret key file as key file is not recommended for security reason.
Service account keys could pose a security risk if compromised. We recommend that you avoid downloading service account keys
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，有一种方法可以在Python程序中使用无钥匙的身份验证。它称为 workload noreload Identity vederation Federation（wif）。
使用wif，您可以使用外部提供商生成 openID noreid connect （oidc）<强>身份令牌。此外部提供商可以是IDAA（身份作为服务），例如 okta ， auth0 或 authlete>这可以是您自己建立的东西。更准确地说，您需要创建一个OAuth 2.0 /a>，例如，使用 authlib 。我从来没有自己做过，但是我敢肯定这是很多工作。
设置了外部身份提供商后，您将需要配置工作负载身份池：
就个人而言，我会三思而后行地自己实施OAuth 2.0授权服务器。我不想担心发出正确的令牌类型，当然我不想担心管理令牌数据库（将其黑名单，使其无效等）。我很可能会下载服务帐户的JSON密钥，并在我的Python程序中使用它，或者支付IDAA来发行ID令牌（即Workload Identity Federation中使用的外部身份提供商）。
Yes, there is a way to use a keyless authentication in your python program. It's called Workload Identity Federation (WIF).
With WIF you use an external provider to generate a OpenID Connect (OIDC) identity token. This external provider can be an IDaaS (IDentity as a Service) like Okta, Auth0 or Authlete, or it can be something you build yourself. More precisely, you would need to create an OAuth 2.0 authorization server, for example using a library like Authlib. I've never done it myself, but I'm sure it's a lot of work.
Once you have set up the external identity provider, you will need to configure a workload identity pool:
Personally, I would think twice about implementing an OAuth 2.0 authorization server myself. I don't want to worry about issuing the correct type of token, and certainly I do not want to worry about managing the database of tokens (blacklisting them, invalidating them, etc). Most likely I would either download the JSON key of a service account and use it in my python program, or pay an IDaaS to use to issue ID tokens (i.e. the external identity provider used in Workload Identity Federation).
如果您的Python程序在Google Cloud之外运行，则不，您必须使用凭据。
你有一个捕获22。您需要使用凭证授权，以模仿另一个凭据。
您有三个选择：
的每种方法都需要秘密。
对于计算服务，例如计算引擎，云功能，云运行等，您可以使用元数据服务进行授权。但是，那么您就不需要模仿凭据，就可以使用凭据，因为它们是安全的（机器上没有秘密）。
我写了一篇有关此主题的文章以及如何使用用户帐户凭据设置模仿的文章：
Google Cloud - 通过假冒的安全性提高安全性
如果正确设置了模仿，则不需要Flag - 不需要模拟服务。
If your Python program is running outside Google Cloud, then no, you must use credentials.
You have a catch22. You need to be authorized using credentials to impersonate another credential.
You have three choices:
Each of those methods requires secrets.
For compute services, such as Compute Engine, Cloud Functions, Cloud Run, etc you can use the metadata service for authorization. However, then you do not need to impersonate credentials, you can just use the credentials as they are safe (no secrets stored on the machine).
I wrote an article on this topic and how to setup impersonation using user account credentials:
Google Cloud – Improving Security with Impersonation
If impersonation is set up correctly, the flag --impersonate-service-account is not required.