Google Cloud Secrets Manager 拒绝访问 App Engine 应用程序，但可与 Google Cloud Function 一起使用

Question

I'm trying to connect to get a secret from google's secrets manager, and the same code works for Cloud Functions, but not for App Engine.

const { SecretManagerServiceClient } = require('@google-cloud/secret-manager');

const secretManagerServiceClient = new SecretManagerServiceClient();
const name = 'projects/000000000000/secrets/database/versions/latest';

exports.testSecretManager = async (req, res) => {
  const [version] = await secretManagerServiceClient.accessSecretVersion({ name });
  const payload = version.payload.data.toString();
  console.debug(`Payload: ${payload}`);
  res.sendStatus(200);
};

The same code works fine when I deploy it as a function.

But when I run the same code as a part of App Engine application. It fails with this error:

Error: 16 UNAUTHENTICATED: Failed to retrieve auth metadata with error: Could not refresh access token: Unsuccessful response status code. Request failed with status code 500
    at Object.callErrorFromStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call.js:31:26)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client.js:180:52)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:365:141)
    at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:328:181)
    at /workspace/node_modules/@grpc/grpc-js/build/src/call-stream.js:182:78
    at processTicksAndRejections (node:internal/process/task_queues:78:11)

I believe both Cloud Functions and App Engine are managed by the same service account “App Engine default service account”. And it has rights.

It seems like GOOGLE_APPLICATION_CREDENTIALS is missing from the environment.

console.log(process.env.GOOGLE_APPLICATION_CREDENTIALS); gives me undefined. Can this be a reason? How do I pass this environment to app engine then?

How can I deeper debug this?

Answer 1

Make sure that Secret Manager Secret Accessor role is granted to the Service Account from IAM for the App Engine. The exact role you would need to add is: roles/secretmanager.secretAccessor. You may refer here for more details.

Also, have a look at this Stackoverflow case .

Answer 2

The Google Cloud documentation notes:

To use Secret Manager with workloads running on App Engine, you must grant any required permissions to the App Engine service.

I can verify that it worked correctly in my case (although I did have to specify the correct app ID in my secret request, and enable the Secret Accessor role for the service account in the IAM console .)

Answer 3

Please find here a beautifully written answer.

And, also the official Google documentation which doesn't list GAE as a directly supported product, however, GCE/GKE are supported out of the box, if that's an option for you.