how can I key rotate for google cloud storage service account?

问题

I have written code for accessing GCS bucket to store files thru API in java which takes JSON credential file. I have created that JSON file from google console. I need to automate the JSON file or key rotation for every 90 days. How to regenerate/rotate that JSON file? I am a newbie to GCS.

import java.io.IOException;
import java.security.GeneralSecurityException;

import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpMethods;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpRequestFactory;
import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.iam.v1.Iam;
import com.google.api.services.iam.v1.IamRequest;
import com.google.api.services.iam.v1.IamRequestInitializer;
import com.google.api.services.iam.v1.model.CreateServiceAccountKeyRequest;
public class TestServiceAccount {

    public static void main(String[] args) {
        // TODO Auto-generated method stub
            //ServiceAccountKey  key = new ServiceAccountKey();

            try {
                System.out.println("created");
                String KEY = "AIzaSyDjHg2u4bwfvncb_YwdjJC_vUPRYLW5Sh8";
                IamRequestInitializer req = new IamRequestInitializer(KEY);
                HttpTransport transport;
                transport = GoogleNetHttpTransport.newTrustedTransport();
                JsonFactory jsonFactory = new JacksonFactory();


                Iam iam = new Iam(transport,jsonFactory,new HttpRequestInitializer() {

                    public void initialize(HttpRequest httpRequest) {

                        httpRequest.setConnectTimeout(0);
                        httpRequest.setReadTimeout(0);
                    }
                });
                //https://iam.googleapis.com/v1/projects/newsampleproject/serviceAccounts/NewServiceAccount/keys
                MyIamRequest<String> request = new MyIamRequest<String>(
                        iam, HttpMethods.POST, "/v1/projects/newsampleproject/serviceAccounts/NewServiceAccount/keys", String.class, String.class);
                req.initialize(request);
                System.out.println(req.getKey());
                req.initializeJsonRequest(request);
                System.out.println(req.getUserIp());
            } catch (GeneralSecurityException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            } catch (IOException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }catch (Exception e) {
                e.printStackTrace();
            }



            //req.initializeJsonRequest(request);
    }

    public static HttpRequestFactory createRequestFactory(HttpTransport transport) {
        return transport.createRequestFactory(new HttpRequestInitializer() {
          public void initialize(HttpRequest request) throws IOException {

          }
        });
      }

}

This what I have written to call the API But i am not sure if this is the way to call it.

回答1:

try this solution, it worked for me

private static void createNewKey(IamRequestInitializer req) throws IOException, GeneralSecurityException {
        Iam iam = jsonAuthentication();
        CreateServiceAccountKeyRequest keyRequest = new CreateServiceAccountKeyRequest();
        keyRequest.setKeyAlgorithm(KEY_ALGO);
        String account = SERVICE_ACCOUNT_URL + SERVICE_ACCOUNT_EMAIL;
        iam.projects().serviceAccounts().keys().create(account, keyRequest);
        String requestString = BASE_URL + SERVICE_ACCOUNT_EMAIL + KEY;
        ServiceAccountKey result = getServiceAccountKey(req, iam, requestString);
        String jsonKey = new String(result.decodePrivateKeyData());
        System.out.println(jsonKey);
        JsonFileUtil.createFile(JSON_KEY_FILE_NAME, jsonKey);
    }

    private static <T> T getServiceAccountKey(IamRequestInitializer req, Iam iam, String requestString)
            throws IOException {
        MyIamRequest<String> request = new MyIamRequest<String>(iam, HttpMethods.POST, requestString, String.class,
                ServiceAccountKey.class);
        request.setKey(API_KEY);
        request.setFields(
                "keyAlgorithm,name,privateKeyData,privateKeyType,publicKeyData,validAfterTime,validBeforeTime");
        req.initializeJsonRequest(request);
        System.out.println(request.getRequestHeaders());
        return (T) request.execute();
    }

回答2:

If you're using a JSON credential file, you are acting as some particular service account which is a member of your project and has access to the files.

Service accounts can be programmatically controlled for exactly this sort of use case. The IAM Service Account API controls service accounts, and the two methods you want for key rotation are serviceAccount.keys.create() and serviceAccount.keys.delete().

The result of the create() call (if you pass in the private key type TYPE_GOOGLE_CREDENTIALS_FILE), will be a new, valid JSON credential file for your service account.

回答3:

@user7049946

ServiceAccountKey response = getServiceAccountKey(req, iam, requestString);
CreateNewJson.createFile("NEW_JSON_KEY_FILE_NAME", new String(response.decodePrivateKeyData()));

create new class to convert that conent into new file.

public class CreateNewJson {
    public static void createFile(String filename, String content) throws IOException {
        FileOutputStream fileOutputStream = null;
        File file;
        file = new File(filename);
        fileOutputStream = new FileOutputStream(file);
            if (!file.exists()) {
                file.createNewFile();
            }else{
                file.delete();
                file.createNewFile();
            }
            byte[] contentInBytes = content.getBytes();
            fileOutputStream.write(contentInBytes);
            fileOutputStream.flush();
            fileOutputStream.close();
            System.out.println("File Created");
    }
}

来源：https://stackoverflow.com/questions/40064306/how-can-i-key-rotate-for-google-cloud-storage-service-account