Question

在Google Cloud Run下，您可以选择容器正在运行的服务帐户。使用默认的计算服务帐户无法生成签名的URL。

如果您允许服务帐户的所有范围，则此处列出的解决方法适用于Google Cloud Compute。在Cloud Run中似乎并没有做到这一点（我找不到）。

https://github.com/googleapis/google-auth-library-python/issues/50

我尝试过的事情：

为服务帐户分配角色：roles/iam.serviceAccountTokenCreator
在虚拟机中的同一个GCP项目中（相对于Cloud Run）验证了解决方法
验证代码是否在容器中本地工作，并具有从私钥（通过json文件）加载的服务帐户。

from google.cloud import storage
client = storage.Client()
bucket = client.get_bucket('EXAMPLE_BUCKET')
blob = bucket.get_blob('libraries/image_1.png')
expires = datetime.now() + timedelta(seconds=86400)
blob.generate_signed_url(expiration=expires)

失败：

you need a private key to sign credentials.the credentials you are currently using <class 'google.auth.compute_engine.credentials.Credentials'> just contains a token. see https://googleapis.dev/python/google-api-core/latest/auth.html#setting-up-a-service-account for more details.
/usr/local/lib/python3.8/site-packages/google/cloud/storage/_signing.py, line 51, in ensure_signed_credentials

尝试添加解决方法，

Error calling the IAM signBytes API: 
{  "error": {  "code": 400,

    "message": "Request contains an invalid argument.",
    "status": "INVALID_ARGUMENT"  }
}
Exception Location: /usr/local/lib/python3.8/site-packages/google/auth/iam.py, line 81, in _make_signing_request

Github问题中提到的解决方法代码：

from google.cloud import storage
from google.auth.transport import requests
from google.auth import compute_engine
from datetime import datetime, timedelta

def get_signing_creds(credentials):
    auth_request = requests.Request()
    print(credentials.service_account_email)
    signing_credentials = compute_engine.IDTokenCredentials(auth_request, "", service_account_email=credentials.ser
vice_account_email)
    return signing_credentials


client = storage.Client()
bucket = client.get_bucket('EXAMPLE_BUCKET')
blob = bucket.get_blob('libraries/image_1.png')
expires = datetime.now() + timedelta(seconds=86400)
signing_creds = get_signing_creds(client._credentials)
url = blob.generate_signed_url(expiration=expires, credentials=signing_creds)
print(url)

如何在Google Cloud Run下生成签名的URL？此时，似乎我可能必须挂载想要避免的服务帐户密钥。

编辑：为了弄清楚，服务帐户具有正确的权限-它可以在GCE中使用，并且可以在本地使用JSON私钥。

Answer 1

是的，但是我必须深入研究以找到方法（如果您不关心细节，请跳到最后）

如果您进入_signing.py file, line 623，可以看到此

if access_token and service_account_email:
   signature = _sign_message(string_to_sign, access_token, service_account_email)
...

如果提供access_token和service_account_email，则可以使用_sign_message方法。此方法使用IAM service SignBlob API处的this line

这很重要，因为您现在可以在本地没有私钥的情况下对Blob进行签名！这样就解决了问题，下面的代码可以在Cloud Run上运行（我确定可以在Cloud Function上运行）

def sign_url():
    from google.cloud import storage
    from datetime import datetime, timedelta

    import google.auth
    credentials, project_id = google.auth.default()

    # Perform a refresh request to get the access token of the current credentials (Else, it's None)
    from google.auth.transport import requests
    r = requests.Request()
    credentials.refresh(r)

    client = storage.Client()
    bucket = client.get_bucket('EXAMPLE_BUCKET')
    blob = bucket.get_blob('libraries/image_1.png')
    expires = datetime.now() + timedelta(seconds=86400)

    # In case of user credential use, define manually the service account to use (for development purpose only)
    service_account_email = "YOUR DEV SERVICE ACCOUNT"
    # If you use a service account credential, you can use the embedded email
    if hasattr(credentials, "service_account_email"):
        service_account_email = credentials.service_account_email

    url = blob.generate_signed_url(expiration=expires,service_account_email=service_account_email, access_token=credentials.token)
    return url, 200

让我知道是否不清楚

Answer 2

您不能使用默认服务帐户对网址进行签名。

使用具有权限的专用服务帐户再次尝试服务代码，看看是否可以解决您的错误

参考文献和进一步阅读：

Answer 3

已将更新的方法添加到 GCP 的 documentation 中，用于 Cloud Run 和 App Engine 等无服务器实例。

以下 snippet 显示了如何从存储库创建签名 URL。

def generate_upload_signed_url_v4(bucket_name, blob_name):
    """Generates a v4 signed URL for uploading a blob using HTTP PUT.

    Note that this method requires a service account key file. You can not use
    this if you are using Application Default Credentials from Google Compute
    Engine or from the Google Cloud SDK.
    """
    # bucket_name = 'your-bucket-name'
    # blob_name = 'your-object-name'

    storage_client = storage.Client()
    bucket = storage_client.bucket(bucket_name)
    blob = bucket.blob(blob_name)

    url = blob.generate_signed_url(
        version="v4",
        # This URL is valid for 15 minutes
        expiration=datetime.timedelta(minutes=15),
        # Allow PUT requests using this URL.
        method="PUT",
        content_type="application/octet-stream",
    )


    return url

一旦您的后端返回签名 URL，您就可以从前端执行 curl put 请求，如下所示

curl -X PUT -H 'Content-Type: application/octet-stream' --upload-file my-file 'my-signed-url'

如何在Google Cloud Run中生成Blob签名的网址？

3 个答案: