getSignedUrl using Workload Identity Federation

[andrewmcoupe]

I'm using google-auth-library to access Google Cloud resources from AWS which works nicely and allows me to upload a file to my required bucket. When I attempt to get a signed url using

const [url] = await myBucket
        .file(fileName)
        .getSignedUrl({
          expires: Date.now() + 15 * 60 * 1000, // 15 minutes
          action: 'read',
        });

I get a SignatureDoesNotMatch error when trying to access the URL in a web browser.

If I generate a service account keyfile and provide the private_key field from the file when I instantiate Storage then the signed URL works (see code below).

Does getting a signed URL not work well with Workload Identity Federation?

      credentials: {
        client_email: clientEmail!,
        private_key: process.env.GOOGLE_PRIVATE_KEY.replace(
          new RegExp('\\\\n', 'g'),
          '\n',
        ),
      },
    });

For some context, I followed this walkthrough: https://www.youtube.com/watch?v=Eh0mJwFo9Ak&t=800s

[JesseLovelace]

Hey Andrew, thanks for bringing this to our attention. I'm looking into this, trying to familiarize myself with Workload Identity Federation. Just to make sure I have it right, you've created an AWS role which is impersonating a GCS service account, and pointed GOOGLE_APPLICATION_CREDENTIALS to the file with the credentials for this role in the settings for your lambda function? The service account is ultimately used in the signing process so it's possible that with this setup it's not resolving correctly. At first glance I'm not sure why but my guess would be some issue with the auth library

[andrewmcoupe]

@JesseLovelace Yep, you have my setup correct. The path to the credentials seems to be resolving as I can access the storage bucket with no problems, just resolving a signed URL seems to be the blocker. To get this I have to generate a service account creds file and use the private_key from there.

[JesseLovelace]

Sorry for such a sanity-check type question, but what version of google-auth-library are you using? I'm only asking because it seems that support for signing via impersonated credentials was added very recently, as in 12 days ago recently. If you're on that version or later I'll cut an issue with google-auth-library, I have to assume it's some problem with that implementation of signing via impersonated credentials

[andrewmcoupe]

@JesseLovelace I am actually on 7.6.2 so it should work? I've looked at the changes made in that release and I have the correct permissions setup for the service account being impersonated (Token Creator).

[JesseLovelace]

Cut googleapis/google-auth-library-nodejs#1239 with auth library

[danielduhh]

Can we close this? @ddelgrosso1

[ddelgrosso1]

This should now be resolved with the above fixes. Closing.