airbytehq / airbytehq/airbyte

BigQuery impersonate service account

Aberta
#15,726 12 comentários 6 reações 0 responsáveis Ver no GitHub
autoteam community connectors/destination/bigquery connectors/source/bigquery frozen team/destinations type/enhancement
Linguagem predominante
Python
Estrelas
22.1k
Forks
5.4k
Merge médio
5h
PRs com merge (30d)
671

Descrição

## Tell us about the problem you're trying to solve
In the BigQuery connector, I would like to use Application Default Credentials (I think this is already supported) but then use those credentials to impersonate a different service account.

Example: https://github.com/salrashid123/gcp_impersonated_credentials/blob/main/java/src/main/java/com/test/TestApp.java#L28-L30

## Describe the solution you’d like
BigQuery connector should continue to accept JSON credentials for authenticating but then fall back to ADC. Then, if the configuration field for setting a "Account to impersonate" is set, we should attempt to impersonate that account before attempting to access the table.

For accessing the target table, if this feature works, then the ADC credentials will not need any access to the target BigQuery, only the impersonated account does.

This is a crucial component for using Airbyte in a multi-tenant customer environment.

## Describe the alternative you’ve considered or used
We have no alternative; our security posture as a business is strengthened by using as few hardcoded credentials as possible. Airbyte's BigQuery connector is not usable for us at this time until we can use our existing service accounts in a credentialless fashion.

## Additional context
https://cloud.google.com/iam/docs/impersonating-service-accounts

## Are you willing to submit a PR?
It'll probably be a very long time before I'd have time to, but theoretically I am willing to.

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.