BigQuery impersonate service account
- Vorherrschende Sprache
- Python
- Sterne
- 22.1k
- Forks
- 5.3k
- PR-Merge-Kennzahlen
- PR-Kennzahlen ausstehend
Beschreibung
## Tell us about the problem you're trying to solve
In the BigQuery connector, I would like to use Application Default Credentials (I think this is already supported) but then use those credentials to impersonate a different service account.
Example: https://github.com/salrashid123/gcp_impersonated_credentials/blob/main/java/src/main/java/com/test/TestApp.java#L28-L30
## Describe the solution you’d like
BigQuery connector should continue to accept JSON credentials for authenticating but then fall back to ADC. Then, if the configuration field for setting a "Account to impersonate" is set, we should attempt to impersonate that account before attempting to access the table.
For accessing the target table, if this feature works, then the ADC credentials will not need any access to the target BigQuery, only the impersonated account does.
This is a crucial component for using Airbyte in a multi-tenant customer environment.
## Describe the alternative you’ve considered or used
We have no alternative; our security posture as a business is strengthened by using as few hardcoded credentials as possible. Airbyte's BigQuery connector is not usable for us at this time until we can use our existing service accounts in a credentialless fashion.
## Additional context
https://cloud.google.com/iam/docs/impersonating-service-accounts
## Are you willing to submit a PR?
It'll probably be a very long time before I'd have time to, but theoretically I am willing to.
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.