How to Authorize googlecloudstorage with a service account

Howto Guides
1

We all know it's preferable to authorize rclone with a service account. Service-accounts practice POLP by reducing the permissions scope to only the narrow permissions needed to complete the task. Using user permissions give rclone broad access to your account.

This guide explains how to obtain a service account access-token via gcloud CLI without generating a service-account-keys. Service-account keys are an issue because (a) they can be breached and (b) they are a pain to generate. An account-token is temporary

The overall process includes

  1. Create a service account using
gcloud iam service-accounts create gcs-read-only
  1. Attach read-only role to the service account
PROJECT_ID=my-project
 gcloud --verbose iam service-accounts add-iam-policy-binding \
    gcs-read-only@${PROJECT_ID}.iam.gserviceaccount.com  \
    --member=serviceAccount:gcs-read-only@${PROJECT_ID}.iam.gserviceaccount.com \
    --role=roles/storage.objectUser
  1. Get access key for service account
 gcloud auth application-default print-access-token  \
   --impersonate-service-account \
       dev-gcloud-go@${PROJECT_ID}.iam.gserviceaccount.com  

ya29.c.c0ASRK0GbAFEewXD [truncated]

  1. update rclone.conf
    find {access_token": "xxx"} and replace the value with the access token from step 3

  2. Run rclone as usual

rclone ls dev-gcs:${MY_BUCKET}/

More Info on Service Accounts

2

A few more benefits of using service accounts with access tokens (instead of json key files)

  • The tokens are temporary and expire when you want them to
  • no need for the clumsy oauth flow. this is great on remote SSH without access to a web browser
  • You don't need to authorize the Rclone App ID to your account. The Rclone APP ID authoriztation opens up access to your google account to the rclone app ID owner.
3

Thank you for writing this up. Do you want to contribute this to the rclone docs? Perhaps another section in this doc?

We could also come up with a command line to do the config file editing

rclone config update

Should be able to do it. It might need an extra flag to stop rclone asking for a new token!

4

thanks for calling that out. i'll update those docs

5

Here's a PR for the docs. I'll look into the config option as it would be an improvement.

6

Hey Tony,

Why are you getting the access token for the dev-gcloud-go service account when you created the gcs-read-only service account for rclone to use to access to GCS bucket? Isn't it just ending up using the permissions applied to the dev-gcloud-go account?

7

i'm sorry the service account should be gcs-read-only in step #3

8

Hi @Tony_M, I try to use short live token but I have the error failed to configure Google Cloud Storage: google: could not find default credentials.. It's seem like the client still try using ADC instead token, do you have an idea ?

details of my issue : Using service account access token with GCP is not working

Thanks

Edit : My bad, the access_token feature is not yet released. I have build rclone from master and it's working !