pulumi-gcp-kotlin/com.pulumi.gcp.serviceaccount.kotlin/ServiceaccountFunctions/getAccountAccessToken

getAccountAccessToken

suspend fun getAccountAccessToken(argument: GetAccountAccessTokenPlainArgs): GetAccountAccessTokenResult

This data source provides a google oauth2 access_token for a different service account than the one initially running the script. For more information see the official documentation as well as iamcredentials.generateAccessToken()

Example Usage

To allow service_A to impersonate service_B, grant the Service Account Token Creator on B to A. In the IAM policy below, service_A is given the Token Creator role impersonate service_B

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const token_creator_iam = new gcp.serviceaccount.IAMBinding("token-creator-iam", {
    serviceAccountId: "projects/-/serviceAccounts/service_B@projectB.iam.gserviceaccount.com",
    role: "roles/iam.serviceAccountTokenCreator",
    members: ["serviceAccount:service_A@projectA.iam.gserviceaccount.com"],
});
Content copied to clipboard
import pulumi
import pulumi_gcp as gcp
token_creator_iam = gcp.serviceaccount.IAMBinding("token-creator-iam",
    service_account_id="projects/-/serviceAccounts/service_B@projectB.iam.gserviceaccount.com",
    role="roles/iam.serviceAccountTokenCreator",
    members=["serviceAccount:service_A@projectA.iam.gserviceaccount.com"])
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
    var token_creator_iam = new Gcp.ServiceAccount.IAMBinding("token-creator-iam", new()
    {
        ServiceAccountId = "projects/-/serviceAccounts/service_B@projectB.iam.gserviceaccount.com",
        Role = "roles/iam.serviceAccountTokenCreator",
        Members = new[]
        {
            "serviceAccount:service_A@projectA.iam.gserviceaccount.com",
        },
    });
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/serviceaccount"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := serviceaccount.NewIAMBinding(ctx, "token-creator-iam", &serviceaccount.IAMBindingArgs{
			ServiceAccountId: pulumi.String("projects/-/serviceAccounts/service_B@projectB.iam.gserviceaccount.com"),
			Role:             pulumi.String("roles/iam.serviceAccountTokenCreator"),
			Members: pulumi.StringArray{
				pulumi.String("serviceAccount:service_A@projectA.iam.gserviceaccount.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceaccount.IAMBinding;
import com.pulumi.gcp.serviceaccount.IAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var token_creator_iam = new IAMBinding("token-creator-iam", IAMBindingArgs.builder()
            .serviceAccountId("projects/-/serviceAccounts/service_B@projectB.iam.gserviceaccount.com")
            .role("roles/iam.serviceAccountTokenCreator")
            .members("serviceAccount:service_A@projectA.iam.gserviceaccount.com")
            .build());
    }
}
Content copied to clipboard
resources:
  token-creator-iam:
    type: gcp:serviceaccount:IAMBinding
    properties:
      serviceAccountId: projects/-/serviceAccounts/service_B@projectB.iam.gserviceaccount.com
      role: roles/iam.serviceAccountTokenCreator
      members:
        - serviceAccount:service_A@projectA.iam.gserviceaccount.com
Content copied to clipboard

Once the IAM permissions are set, you can apply the new token to a provider bootstrapped with it. Any resources that references the aliased provider will run as the new identity. In the example below, gcp.organizations.Project will run as service_B.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
export = async () => {
    const default = await gcp.organizations.getClientConfig({});
    const defaultGetAccountAccessToken = await gcp.serviceaccount.getAccountAccessToken({
        targetServiceAccount: "service_B@projectB.iam.gserviceaccount.com",
        scopes: [
            "userinfo-email",
            "cloud-platform",
        ],
        lifetime: "300s",
    });
    const me = await gcp.organizations.getClientOpenIdUserInfo({});
    return {
        "target-email": me.email,
    };
}
Content copied to clipboard
import pulumi
import pulumi_gcp as gcp
default = gcp.organizations.get_client_config()
default_get_account_access_token = gcp.serviceaccount.get_account_access_token(target_service_account="service_B@projectB.iam.gserviceaccount.com",
    scopes=[
        "userinfo-email",
        "cloud-platform",
    ],
    lifetime="300s")
me = gcp.organizations.get_client_open_id_user_info()
pulumi.export("target-email", me.email)
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
    var @default = Gcp.Organizations.GetClientConfig.Invoke();
    var defaultGetAccountAccessToken = Gcp.ServiceAccount.GetAccountAccessToken.Invoke(new()
    {
        TargetServiceAccount = "service_B@projectB.iam.gserviceaccount.com",
        Scopes = new[]
        {
            "userinfo-email",
            "cloud-platform",
        },
        Lifetime = "300s",
    });
    var me = Gcp.Organizations.GetClientOpenIdUserInfo.Invoke();
    return new Dictionary<string, object?>
    {
        ["target-email"] = me.Apply(getClientOpenIdUserInfoResult => getClientOpenIdUserInfoResult.Email),
    };
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/serviceaccount"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.GetClientConfig(ctx, nil, nil)
		if err != nil {
			return err
		}
		_, err = serviceaccount.GetAccountAccessToken(ctx, &serviceaccount.GetAccountAccessTokenArgs{
			TargetServiceAccount: "service_B@projectB.iam.gserviceaccount.com",
			Scopes: []string{
				"userinfo-email",
				"cloud-platform",
			},
			Lifetime: pulumi.StringRef("300s"),
		}, nil)
		if err != nil {
			return err
		}
		me, err := organizations.GetClientOpenIdUserInfo(ctx, nil, nil)
		if err != nil {
			return err
		}
		ctx.Export("target-email", me.Email)
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.serviceaccount.ServiceaccountFunctions;
import com.pulumi.gcp.serviceaccount.inputs.GetAccountAccessTokenArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var default = OrganizationsFunctions.getClientConfig();
        final var defaultGetAccountAccessToken = ServiceaccountFunctions.getAccountAccessToken(GetAccountAccessTokenArgs.builder()
            .targetServiceAccount("service_B@projectB.iam.gserviceaccount.com")
            .scopes(
                "userinfo-email",
                "cloud-platform")
            .lifetime("300s")
            .build());
        final var me = OrganizationsFunctions.getClientOpenIdUserInfo();
        ctx.export("target-email", me.applyValue(getClientOpenIdUserInfoResult -> getClientOpenIdUserInfoResult.email()));
    }
}
Content copied to clipboard
variables:
  default:
    fn::invoke:
      Function: gcp:organizations:getClientConfig
      Arguments: {}
  defaultGetAccountAccessToken:
    fn::invoke:
      Function: gcp:serviceaccount:getAccountAccessToken
      Arguments:
        targetServiceAccount: service_B@projectB.iam.gserviceaccount.com
        scopes:
          - userinfo-email
          - cloud-platform
        lifetime: 300s
  me:
    fn::invoke:
      Function: gcp:organizations:getClientOpenIdUserInfo
      Arguments: {}
outputs:
  target-email: ${me.email}
Content copied to clipboard

Note: the generated token is non-refreshable and can have a maximum lifetime of 3600 seconds.

Return

A collection of values returned by getAccountAccessToken.

Parameters

argument

A collection of arguments for invoking getAccountAccessToken.

suspend fun getAccountAccessToken(delegates: List<String>? = null, lifetime: String? = null, scopes: List<String>, targetServiceAccount: String): GetAccountAccessTokenResult

Return

A collection of values returned by getAccountAccessToken.

Parameters

delegates

Delegate chain of approvals needed to perform full impersonation. Specify the fully qualified service account name. (e.g. ["projects/-/serviceAccounts/delegate-svc-account@project-id&#46;iam&#46;gserviceaccount&#46;com"])

lifetime

Lifetime of the impersonated token (defaults to its max: 3600s).

scopes

The scopes the new credential should have (e.g. ["cloud-platform"])

targetServiceAccount

The service account to impersonate (e.g. service_B@your-project-id.iam.gserviceaccount.com)

See also

.

suspend fun getAccountAccessToken(argument: suspend GetAccountAccessTokenPlainArgsBuilder.() -> Unit): GetAccountAccessTokenResult

Return

A collection of values returned by getAccountAccessToken.

Parameters

argument

Builder for com.pulumi.gcp.serviceaccount.kotlin.inputs.GetAccountAccessTokenPlainArgs.

See also

.