GoogleCloudPlatform / GoogleCloudPlatform/gsutil

Stale credentials in credstore after recreating service account

Open
#549 2 comments 4 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
918
Forks
335
PR merge metrics
No merged PRs in 30d

Description

We have a service account with access to a bucket. If we delete and then recreate the identical service account, it can not access the bucket unless we delete ~/.gsutil.

Script reproducing the issue:
```bash
#!/bin/bash
set -u
user=$MY_SERVICE_ACCOUNT
project=$MY_PROJECT
bucket=$MY_BUCKET

full_user=${user}@${project}.iam.gserviceaccount.com

function create_service_account {
gcloud iam service-accounts create ${user} --project $project --quiet

role="roles/storage.admin"
gcloud projects add-iam-policy-binding $project \
--member="serviceAccount:${full_user}" \
--role="${role}" > /dev/null

gcloud iam service-accounts keys create "${user}.key.json" \
--iam-account="${full_user}" \
--project $project
}

function activate_service_account {
gcloud auth activate-service-account --key-file ${user}.key.json
}

function delete_service_account {
roles=$(gcloud projects get-iam-policy $project \
--flatten="bindings[].members" \
--format='table(bindings.role)' \
--filter="bindings.members:${full_user}" \
--format=json | jq -r ".[] | .bindings.role")

for role in ${roles[@]}
do
echo "Removing role: $role"
gcloud projects remove-iam-policy-binding $project \
--member="serviceAccount:${full_user}" \
--role="${role}" > /dev/null
done

gcloud iam service-accounts delete ${full_user}
}

gcloud auth login # as owner/editor
create_service_account
activate_service_account

gsutil ls gs://${bucket}/ # works as expected

gcloud auth login
delete_service_account

create_service_account
activate_service_account

gsutil -DD ls gs://${bucket}/ # error

rm -rf ~/.gsutil

activate_service_account
gsutil ls gs://${bucket}/ # works

gcloud auth login
delete_service_account
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.