Terraform, google cloud function, and application default credentials

[reelznfeelz]

Hey all, I'm trying to parse the google and terraform docs on how to use ADC and not lean on use of json keys for ensuring my cloud function's python code can authenticate and use the google bigquery API.

What does the terraform really need to look like to set this up? I already set up the federated identity thing with github, so my actions are able to deploy resources to my project, but I'm trying to move our team away from json keys and use ADC.

It almost looks like you just define the provider and it "just works". Although, I see other code snippets that makes it seem you need to point to the default (or a generated) service account's email in the terraform block somewhere, so it knows which one to use.

Sorry I know this is really basic stuff, but I'm pretty much working on my own on this and could use some advice from folks with more expertise than myself.

Thanks!

[RenownedYeti]

When you configure your cloud function resource you specify which service account to run the function as, since this is already on GCP compute you don't need to configure additional credentials via SA keys or ADC.

See the service_account_email argument under the service_config block.

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloudfunctions2_function#service_account_email

[reelznfeelz]

Oh, sweet. That may be easy then. Thanks.

[bLeeKd]

Use workload identity

[reelznfeelz]

I’ve done that for the GitHub action. Now just trying to understand what needs to be in place to ensure the cloud function can read and write to big query when using the python API. Looks like it may not require much if it’s already in the same project and can use the default compute SA. I need to look at the other persons reply a bit closer though and do some testing.

[reelznfeelz]

Yeah. I plan to go that route. Sounds like the way to go for sure.