GoogleCloudPlatform / GoogleCloudPlatform/gsutil
Stale credentials in credstore after recreating service account
- Dominant language
- Python
- Stars
- 918
- Forks
- 335
- PR merge metrics
- No merged PRs in 30d
Description
We have a service account with access to a bucket. If we delete and then recreate the identical service account, it can not access the bucket unless we delete ~/.gsutil.
Script reproducing the issue:
```bash
#!/bin/bash
set -u
user=$MY_SERVICE_ACCOUNT
project=$MY_PROJECT
bucket=$MY_BUCKET
full_user=${user}@${project}.iam.gserviceaccount.com
function create_service_account {
gcloud iam service-accounts create ${user} --project $project --quiet
role="roles/storage.admin"
gcloud projects add-iam-policy-binding $project \
--member="serviceAccount:${full_user}" \
--role="${role}" > /dev/null
gcloud iam service-accounts keys create "${user}.key.json" \
--iam-account="${full_user}" \
--project $project
}
function activate_service_account {
gcloud auth activate-service-account --key-file ${user}.key.json
}
function delete_service_account {
roles=$(gcloud projects get-iam-policy $project \
--flatten="bindings[].members" \
--format='table(bindings.role)' \
--filter="bindings.members:${full_user}" \
--format=json | jq -r ".[] | .bindings.role")
for role in ${roles[@]}
do
echo "Removing role: $role"
gcloud projects remove-iam-policy-binding $project \
--member="serviceAccount:${full_user}" \
--role="${role}" > /dev/null
done
gcloud iam service-accounts delete ${full_user}
}
gcloud auth login # as owner/editor
create_service_account
activate_service_account
gsutil ls gs://${bucket}/ # works as expected
gcloud auth login
delete_service_account
create_service_account
activate_service_account
gsutil -DD ls gs://${bucket}/ # error
rm -rf ~/.gsutil
activate_service_account
gsutil ls gs://${bucket}/ # works
gcloud auth login
delete_service_account
```
Contributor guide
Assessment
This issue has not been assessed yet.