GCPCredentialOption returns the appropriate option.ClientOption for the given GCP credential JSON, supporting both service account keys and external account (Workload Identity Federation) configurations. SECURITY NOTE: ExternalAccount and ImpersonatedServiceAccount credential types do not validate
(credJSON []byte)
| 72 | // do not validate the credential configuration. Malicious URLs in the config could |
| 73 | // pose a security risk. See https://cloud.google.com/docs/authentication/external/externally-sourced-credentials. |
| 74 | func GCPCredentialOption(credJSON []byte) (option.ClientOption, error) { |
| 75 | var cred struct { |
| 76 | Type string `json:"type"` |
| 77 | } |
| 78 | if err := json.Unmarshal(credJSON, &cred); err != nil { |
| 79 | return nil, errors.Wrap(err, "failed to parse GCP credential JSON") |
| 80 | } |
| 81 | switch cred.Type { |
| 82 | case "service_account": |
| 83 | return option.WithAuthCredentialsJSON(option.ServiceAccount, credJSON), nil |
| 84 | case "external_account": |
| 85 | return option.WithAuthCredentialsJSON(option.ExternalAccount, credJSON), nil |
| 86 | case "impersonated_service_account": |
| 87 | return option.WithAuthCredentialsJSON(option.ImpersonatedServiceAccount, credJSON), nil |
| 88 | case "authorized_user": |
| 89 | return option.WithAuthCredentialsJSON(option.AuthorizedUser, credJSON), nil |
| 90 | case "": |
| 91 | return nil, errors.Errorf("GCP credential JSON missing \"type\" field") |
| 92 | default: |
| 93 | return nil, errors.Errorf("unsupported GCP credential type: %q", cred.Type) |
| 94 | } |
| 95 | } |
| 96 | |
| 97 | func GetAzureConnectionConfig(connCfg db.ConnectionConfig) (azcore.TokenCredential, error) { |
| 98 | if azureCredential := connCfg.DataSource.GetAzureCredential(); azureCredential != nil { |