Skip to content

Commit ed1ec7b

Browse files
jkwluiJustinBeckwith
jkwlui
authored and
JustinBeckwith
committed
feat: hmac service account (#751)
1 parent 48f9b44 commit ed1ec7b

File tree

18 files changed

+1869
-9
lines changed

18 files changed

+1869
-9
lines changed

‎.kokoro/pre-system-test.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,8 @@
1515
# limitations under the License.
1616

1717
. .kokoro/setup-vars.sh
18+
19+
# Lease a second service account for testing listing with multiple service accounts
20+
export HMAC_KEY_TEST_SECOND_SERVICE_ACCOUNT=$(./gimmeproj -project=$HMAC_PROJECT lease 15m)
21+
# Add to the list of leased service account for clean up after tests
22+
export LEASED_SERVICE_ACCOUNTS="$LEASED_SERVICE_ACCOUNTS $HMAC_KEY_TEST_SECOND_SERVICE_ACCOUNT"

‎.kokoro/setup-vars.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,21 @@ export GCN_STORAGE_2ND_PROJECT_KEY=${KOKORO_GFILE_DIR}/no-whitelist-key.json
2222

2323
export GOOGLE_CLOUD_KMS_KEY_ASIA="projects/long-door-651/locations/asia/keyRings/test-key-asia/cryptoKeys/test-key-asia"
2424
export GOOGLE_CLOUD_KMS_KEY_US="projects/long-door-651/locations/us/keyRings/test-key-us/cryptoKeys/test-key-us"
25+
26+
# For testing SA HMAC
27+
export HMAC_PROJECT=gimme-acc
28+
curl https://storage.googleapis.com/gimme-proj/linux_amd64/gimmeproj > gimmeproj
29+
chmod +x gimmeproj
30+
./gimmeproj version
31+
32+
export HMAC_KEY_TEST_SERVICE_ACCOUNT=$(./gimmeproj -project=$HMAC_PROJECT lease 15m)
33+
echo Leased service account: $HMAC_KEY_TEST_SERVICE_ACCOUNT
34+
export LEASED_SERVICE_ACCOUNTS=$HMAC_KEY_TEST_SERVICE_ACCOUNT
35+
36+
cleanup_service_accounts () {
37+
for i in $LEASED_SERVICE_ACCOUNTS; do
38+
./gimmeproj -project=$HMAC_PROJECT "done" $i
39+
done
40+
}
41+
42+
trap cleanup_service_accounts EXIT

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,12 @@ has instructions for running the samples.
9797
| Buckets | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/buckets.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/buckets.js,samples/README.md) |
9898
| Encryption | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/encryption.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/encryption.js,samples/README.md) |
9999
| Files | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/files.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/files.js,samples/README.md) |
100+
| Activate HMAC SA Key. | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyActivate.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyActivate.js,samples/README.md) |
101+
| Create HMAC SA Key. | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyCreate.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyCreate.js,samples/README.md) |
102+
| Deactivate HMAC SA Key. | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyDeactivate.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyDeactivate.js,samples/README.md) |
103+
| Delete HMAC SA Key. | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyDelete.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyDelete.js,samples/README.md) |
104+
| Get HMAC SA Key Metadata. | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyGet.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyGet.js,samples/README.md) |
105+
| List HMAC SA Keys Metadata. | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeysList.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeysList.js,samples/README.md) |
100106
| Iam | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/iam.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/iam.js,samples/README.md) |
101107
| Notifications | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/notifications.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/notifications.js,samples/README.md) |
102108
| Quickstart | [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/quickstart.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/quickstart.js,samples/README.md) |

‎samples/README.md‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,12 @@ objects to users via direct download.
2424
* [Buckets](#buckets)
2525
* [Encryption](#encryption)
2626
* [Files](#files)
27+
* [Activate HMAC SA Key.](#activate-hmac-sa-key.)
28+
* [Create HMAC SA Key.](#create-hmac-sa-key.)
29+
* [Deactivate HMAC SA Key.](#deactivate-hmac-sa-key.)
30+
* [Delete HMAC SA Key.](#delete-hmac-sa-key.)
31+
* [Get HMAC SA Key Metadata.](#get-hmac-sa-key-metadata.)
32+
* [List HMAC SA Keys Metadata.](#list-hmac-sa-keys-metadata.)
2733
* [Iam](#iam)
2834
* [Notifications](#notifications)
2935
* [Quickstart](#quickstart)
@@ -142,6 +148,120 @@ __Usage:__
142148

143149

144150

151+
### Activate HMAC SA Key.
152+
153+
Activate HMAC SA Key.
154+
155+
View the [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyActivate.js).
156+
157+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyActivate.js,samples/README.md)
158+
159+
__Usage:__
160+
161+
162+
`node hmacKeyActivate.js <hmacKeyAccessId> [projectId]`
163+
164+
165+
-----
166+
167+
168+
169+
170+
### Create HMAC SA Key.
171+
172+
Create HMAC SA Key.
173+
174+
View the [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyCreate.js).
175+
176+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyCreate.js,samples/README.md)
177+
178+
__Usage:__
179+
180+
181+
`node hmacKeyCreate.js <serviceAccountEmail> [projectId]`
182+
183+
184+
-----
185+
186+
187+
188+
189+
### Deactivate HMAC SA Key.
190+
191+
Deactivate HMAC SA Key.
192+
193+
View the [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyDeactivate.js).
194+
195+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyDeactivate.js,samples/README.md)
196+
197+
__Usage:__
198+
199+
200+
`node hmacKeyDeactivate.js <hmacKeyAccessId> [projectId]`
201+
202+
203+
-----
204+
205+
206+
207+
208+
### Delete HMAC SA Key.
209+
210+
Delete HMAC SA Key.
211+
212+
View the [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyDelete.js).
213+
214+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyDelete.js,samples/README.md)
215+
216+
__Usage:__
217+
218+
219+
`node hmacKeyDelete.js <hmacKeyAccessId> [projectId]`
220+
221+
222+
-----
223+
224+
225+
226+
227+
### Get HMAC SA Key Metadata.
228+
229+
Get HMAC SA Key Metadata.
230+
231+
View the [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeyGet.js).
232+
233+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeyGet.js,samples/README.md)
234+
235+
__Usage:__
236+
237+
238+
`node hmacKeyGet.js <hmacKeyAccessId> [projectId]`
239+
240+
241+
-----
242+
243+
244+
245+
246+
### List HMAC SA Keys Metadata.
247+
248+
List HMAC SA Keys Metadata.
249+
250+
View the [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/hmacKeysList.js).
251+
252+
[![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/nodejs-storage&page=editor&open_in_editor=samples/hmacKeysList.js,samples/README.md)
253+
254+
__Usage:__
255+
256+
257+
`node hmacKeyList.js [projectId]`
258+
259+
260+
-----
261+
262+
263+
264+
145265
### Iam
146266

147267
View the [source code](https://github.com/googleapis/nodejs-storage/blob/master/samples/iam.js).

‎samples/hmacKeyActivate.js‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
'use strict';
18+
19+
// sample-metadata:
20+
// title: Activate HMAC SA Key.
21+
// description: Activate HMAC SA Key.
22+
// usage: node hmacKeyActivate.js <hmacKeyAccessId> [projectId]
23+
24+
function main(
25+
hmacKeyAccessId = 'GOOG0234230X00',
26+
projectId = 'serviceAccountProjectId'
27+
) {
28+
// [START storage_activate_hmac_key]
29+
// Imports the Google Cloud client library
30+
const {Storage} = require('@google-cloud/storage');
31+
32+
// Creates a client
33+
const storage = new Storage();
34+
35+
// Activate HMAC SA Key
36+
async function activateHmacKey() {
37+
/**
38+
* TODO(developer): Uncomment the following line before running the sample.
39+
*/
40+
// const hmacKeyAccessId = 'HMAC Access Key Id to update, e.g. GOOG0234230X00';
41+
// const projectId = 'The project Id this service account belongs to, e.g. serviceAccountProjectId';
42+
43+
const hmacKey = storage.hmacKey(hmacKeyAccessId, {projectId});
44+
const [hmacKeyMetadata] = await hmacKey.setMetadata({state: 'ACTIVE'});
45+
46+
console.log(`The HMAC key is now active.`);
47+
console.log(`The HMAC key metadata is:`);
48+
for (const [key, value] of Object.entries(hmacKeyMetadata)) {
49+
console.log(`${key}: ${value}`);
50+
}
51+
}
52+
// [END storage_activate_hmac_key]
53+
activateHmacKey();
54+
}
55+
56+
main(...process.argv.slice(2));

‎samples/hmacKeyCreate.js‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
'use strict';
18+
19+
// sample-metadata:
20+
// title: Create HMAC SA Key.
21+
// description: Create HMAC SA Key.
22+
// usage: node hmacKeyCreate.js <serviceAccountEmail> [projectId]
23+
24+
function main(
25+
serviceAccountEmail = 'service-account@example.com',
26+
projectId = 'serviceAccountProjectId'
27+
) {
28+
// [START storage_create_hmac_key]
29+
// Imports the Google Cloud client library
30+
const {Storage} = require('@google-cloud/storage');
31+
32+
// Creates a client
33+
const storage = new Storage();
34+
35+
// Create HMAC SA Key
36+
async function createHmacKey() {
37+
/**
38+
* TODO(developer): Uncomment the following line before running the sample.
39+
*/
40+
// const serviceAccountEmail = 'Service Account Email to associate HMAC Key';
41+
// const projectId = 'The project Id this service account to be created in, e.g. serviceAccountProjectId';
42+
43+
const [hmacKey, secret] = await storage.createHmacKey(serviceAccountEmail, {
44+
projectId,
45+
});
46+
47+
console.log(`The base64 encoded secret is: ${secret}`);
48+
console.log(`Do not miss that secret, there is no API to recover it.`);
49+
console.log(`The HMAC key metadata is:`);
50+
for (const [key, value] of Object.entries(hmacKey.metadata)) {
51+
console.log(`${key}: ${value}`);
52+
}
53+
}
54+
// [END storage_create_hmac_key]
55+
createHmacKey();
56+
}
57+
58+
main(...process.argv.slice(2));

‎samples/hmacKeyDeactivate.js‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
'use strict';
18+
19+
// sample-metadata:
20+
// title: Deactivate HMAC SA Key.
21+
// description: Deactivate HMAC SA Key.
22+
// usage: node hmacKeyDeactivate.js <hmacKeyAccessId> [projectId]
23+
24+
function main(
25+
hmacKeyAccessId = 'GOOG0234230X00',
26+
projectId = 'serviceAccountProjectId'
27+
) {
28+
// [START storage_deactivate_hmac_key]
29+
// Imports the Google Cloud client library
30+
const {Storage} = require('@google-cloud/storage');
31+
32+
// Creates a client
33+
const storage = new Storage();
34+
35+
// Deactivate HMAC SA Key
36+
async function deactivateHmacKey() {
37+
/**
38+
* TODO(developer): Uncomment the following line before running the sample.
39+
*/
40+
// const hmacKeyAccessId = 'HMAC Access Key Id to update, e.g. GOOG0234230X00';
41+
// const projectId = 'The project Id this service account belongs to, e.g. serviceAccountProjectId';
42+
43+
const hmacKey = storage.hmacKey(hmacKeyAccessId, {projectId});
44+
const [hmacKeyMetadata] = await hmacKey.setMetadata({state: 'INACTIVE'});
45+
46+
console.log(`The HMAC key is now inactive.`);
47+
console.log(`The HMAC key metadata is:`);
48+
for (const [key, value] of Object.entries(hmacKeyMetadata)) {
49+
console.log(`${key}: ${value}`);
50+
}
51+
}
52+
// [END storage_deactivate_hmac_key]
53+
deactivateHmacKey();
54+
}
55+
56+
main(...process.argv.slice(2));

0 commit comments

Comments
 (0)