如何为 google 云存储服务帐户轮换密钥？

Question

我已经编写了用于访问 GCS 存储桶的代码，以通过 API 在 java 中存储文件，该文件采用 JSON 凭据文件。我已经从 google 控制台创建了那个 JSON 文件。我需要每 90 天自动执行 JSON 文件或密钥轮换。如何regenerate/rotate那个JSON文件？我是GCS的新手。

import java.io.IOException;
import java.security.GeneralSecurityException;

import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpMethods;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpRequestFactory;
import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.iam.v1.Iam;
import com.google.api.services.iam.v1.IamRequest;
import com.google.api.services.iam.v1.IamRequestInitializer;
import com.google.api.services.iam.v1.model.CreateServiceAccountKeyRequest;
public class TestServiceAccount {

    public static void main(String[] args) {
        // TODO Auto-generated method stub
            //ServiceAccountKey  key = new ServiceAccountKey();

            try {
                System.out.println("created");
                String KEY = "AIzaSyDjHg2u4bwfvncb_YwdjJC_vUPRYLW5Sh8";
                IamRequestInitializer req = new IamRequestInitializer(KEY);
                HttpTransport transport;
                transport = GoogleNetHttpTransport.newTrustedTransport();
                JsonFactory jsonFactory = new JacksonFactory();


                Iam iam = new Iam(transport,jsonFactory,new HttpRequestInitializer() {

                    public void initialize(HttpRequest httpRequest) {

                        httpRequest.setConnectTimeout(0);
                        httpRequest.setReadTimeout(0);
                    }
                });
                //https://iam.googleapis.com/v1/projects/newsampleproject/serviceAccounts/NewServiceAccount/keys
                MyIamRequest<String> request = new MyIamRequest<String>(
                        iam, HttpMethods.POST, "/v1/projects/newsampleproject/serviceAccounts/NewServiceAccount/keys", String.class, String.class);
                req.initialize(request);
                System.out.println(req.getKey());
                req.initializeJsonRequest(request);
                System.out.println(req.getUserIp());
            } catch (GeneralSecurityException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            } catch (IOException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }catch (Exception e) {
                e.printStackTrace();
            }



            //req.initializeJsonRequest(request);
    }

    public static HttpRequestFactory createRequestFactory(HttpTransport transport) {
        return transport.createRequestFactory(new HttpRequestInitializer() {
          public void initialize(HttpRequest request) throws IOException {

          }
        });
      }

}

这是我写的调用 API 但我不确定这是否是调用它的方式。

Answer 1

如果您使用的是 JSON 凭据文件，则您将充当某个特定服务帐户，该帐户是您项目的成员并且可以访问这些文件。

可以针对此类用例以编程方式控制服务帐户。 IAM 服务帐户 API 控制服务帐户，您想要的两种密钥轮换方法是 serviceAccount.keys.create() and serviceAccount.keys.delete().

create() 调用的结果（如果您传入私钥类型 TYPE_GOOGLE_CREDENTIALS_FILE），将为您的服务帐户创建一个新的有效 JSON 凭据文件。

Answer 2

@user7049946

ServiceAccountKey response = getServiceAccountKey(req, iam, requestString);
CreateNewJson.createFile("NEW_JSON_KEY_FILE_NAME", new String(response.decodePrivateKeyData()));

新建 class 将该内容转换为新文件。

public class CreateNewJson {
    public static void createFile(String filename, String content) throws IOException {
        FileOutputStream fileOutputStream = null;
        File file;
        file = new File(filename);
        fileOutputStream = new FileOutputStream(file);
            if (!file.exists()) {
                file.createNewFile();
            }else{
                file.delete();
                file.createNewFile();
            }
            byte[] contentInBytes = content.getBytes();
            fileOutputStream.write(contentInBytes);
            fileOutputStream.flush();
            fileOutputStream.close();
            System.out.println("File Created");
    }
}

Answer 3

试试这个解决方案，它对我有用

private static void createNewKey(IamRequestInitializer req) throws IOException, GeneralSecurityException {
        Iam iam = jsonAuthentication();
        CreateServiceAccountKeyRequest keyRequest = new CreateServiceAccountKeyRequest();
        keyRequest.setKeyAlgorithm(KEY_ALGO);
        String account = SERVICE_ACCOUNT_URL + SERVICE_ACCOUNT_EMAIL;
        iam.projects().serviceAccounts().keys().create(account, keyRequest);
        String requestString = BASE_URL + SERVICE_ACCOUNT_EMAIL + KEY;
        ServiceAccountKey result = getServiceAccountKey(req, iam, requestString);
        String jsonKey = new String(result.decodePrivateKeyData());
        System.out.println(jsonKey);
        JsonFileUtil.createFile(JSON_KEY_FILE_NAME, jsonKey);
    }

    private static <T> T getServiceAccountKey(IamRequestInitializer req, Iam iam, String requestString)
            throws IOException {
        MyIamRequest<String> request = new MyIamRequest<String>(iam, HttpMethods.POST, requestString, String.class,
                ServiceAccountKey.class);
        request.setKey(API_KEY);
        request.setFields(
                "keyAlgorithm,name,privateKeyData,privateKeyType,publicKeyData,validAfterTime,validBeforeTime");
        req.initializeJsonRequest(request);
        System.out.println(request.getRequestHeaders());
        return (T) request.execute();
    }

如何为 google 云存储服务帐户轮换密钥？

how can I key rotate for google cloud storage service account?

google-cloud-storage

service-accounts