如何使用服务帐户在 shell 脚本中对 gsutil 进行身份验证

Question

What is the best way to authenticate to Google Cloud Storage Bucket from a shell script (To be scheduled to run daily/hourly) using a service account ? I have gone through the below link, but I still have some doubts regarding the login process.

How to use Service Accounts with gsutil, for uploading to CS + BigQuery

1. Are the below mentioned login steps a one-time process? If yes how does the login work for subsequent executions?

   My understanding is that the below commands writes content to the .boto file which is used in subsequent executions? But according to below link - it writes to a separate json file inside.config/gcloud? Does gsutil support creating boto files with service account info?

   In such a case what is the use of a.boto file? and why/ when do we need to pass it via BOTO_PATH/BOTO_CONFIG?

   In gsutil (standalone), login using below steps

   gsutil config -e

   Optionally -o to output to a file other than ~/.boto

   gsutil as part of gcloud

   gcloud auth activate-service-account SERVICE_ACCOUNT@DOMAIN.COM --key-file=/path/key.json --project=PROJECT_ID

2. What is the best way to prevent intervention from other scripts?

   For example, let us assume we have shell script S1, connecting to project P1 to upload data to Bucket B1, If another shell script say S2 is triggered at exactly the same time connecting to Project P2 uploading to Bucket B2, will it cause an issue? What is the best practice to avoid such issues?

3. Is it possible to limit the login to only the time of script execution? Say, the script is scheduled using cron to run at 10:00 AM UTC and the script completes its execution by 10:30 AM UTC. Is it possible to prevent any actions in the time between 10:30 till next run? In other words is it possible to log out and then login programatically without intervention?

Environment: Centos

Answer 1

The principle of BOTO file is exactly to answer your question 2. You can have 2 credentials that have access to 2 different buckets. Create 2 boto file and use the correct one for each script.

For the 3rd question it's possible to set condition on the bucket access.

Select a bucket and go to right-hand side in the info panel, and click on add credential.

Then, add your credential, your role, and click on add condition (you must set the uniform permission definition on the bucket to have available that feature)

And then define a condition to allow the permission after 10am your timezone and before 11am your timezone (you don't have minute granularity)