我该如何为Google云端存储服务帐户的密钥进行轮换? [英] how can I key rotate for google cloud storage service account?

问题描述

我已经编写了用于访问GCS存储桶的代码，以通过API将文件存储在带有JSON凭证文件的Java中.我已经从Google控制台创建了该JSON文件.我需要每90天自动执行一次JSON文件或密钥轮换.如何重新生成/旋转该JSON文件?我是GCS的新手.

I have written code for accessing GCS bucket to store files thru API in java which takes JSON credential file. I have created that JSON file from google console. I need to automate the JSON file or key rotation for every 90 days. How to regenerate/rotate that JSON file? I am a newbie to GCS.

import java.io.IOException;
import java.security.GeneralSecurityException;

import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpMethods;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpRequestFactory;
import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.iam.v1.Iam;
import com.google.api.services.iam.v1.IamRequest;
import com.google.api.services.iam.v1.IamRequestInitializer;
import com.google.api.services.iam.v1.model.CreateServiceAccountKeyRequest;
public class TestServiceAccount {

    public static void main(String[] args) {
        // TODO Auto-generated method stub
            //ServiceAccountKey  key = new ServiceAccountKey();

            try {
                System.out.println("created");
                String KEY = "AIzaSyDjHg2u4bwfvncb_YwdjJC_vUPRYLW5Sh8";
                IamRequestInitializer req = new IamRequestInitializer(KEY);
                HttpTransport transport;
                transport = GoogleNetHttpTransport.newTrustedTransport();
                JsonFactory jsonFactory = new JacksonFactory();


                Iam iam = new Iam(transport,jsonFactory,new HttpRequestInitializer() {

                    public void initialize(HttpRequest httpRequest) {

                        httpRequest.setConnectTimeout(0);
                        httpRequest.setReadTimeout(0);
                    }
                });
                //https://iam.googleapis.com/v1/projects/newsampleproject/serviceAccounts/NewServiceAccount/keys
                MyIamRequest<String> request = new MyIamRequest<String>(
                        iam, HttpMethods.POST, "/v1/projects/newsampleproject/serviceAccounts/NewServiceAccount/keys", String.class, String.class);
                req.initialize(request);
                System.out.println(req.getKey());
                req.initializeJsonRequest(request);
                System.out.println(req.getUserIp());
            } catch (GeneralSecurityException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            } catch (IOException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }catch (Exception e) {
                e.printStackTrace();
            }



            //req.initializeJsonRequest(request);
    }

    public static HttpRequestFactory createRequestFactory(HttpTransport transport) {
        return transport.createRequestFactory(new HttpRequestInitializer() {
          public void initialize(HttpRequest request) throws IOException {

          }
        });
      }

}

这是我编写的用来调用API的内容，但是我不确定这是否是调用它的方法.

This what I have written to call the API But i am not sure if this is the way to call it.

推荐答案

尝试此解决方案，它对我有用

try this solution, it worked for me

private static void createNewKey(IamRequestInitializer req) throws IOException, GeneralSecurityException {
        Iam iam = jsonAuthentication();
        CreateServiceAccountKeyRequest keyRequest = new CreateServiceAccountKeyRequest();
        keyRequest.setKeyAlgorithm(KEY_ALGO);
        String account = SERVICE_ACCOUNT_URL + SERVICE_ACCOUNT_EMAIL;
        iam.projects().serviceAccounts().keys().create(account, keyRequest);
        String requestString = BASE_URL + SERVICE_ACCOUNT_EMAIL + KEY;
        ServiceAccountKey result = getServiceAccountKey(req, iam, requestString);
        String jsonKey = new String(result.decodePrivateKeyData());
        System.out.println(jsonKey);
        JsonFileUtil.createFile(JSON_KEY_FILE_NAME, jsonKey);
    }

    private static <T> T getServiceAccountKey(IamRequestInitializer req, Iam iam, String requestString)
            throws IOException {
        MyIamRequest<String> request = new MyIamRequest<String>(iam, HttpMethods.POST, requestString, String.class,
                ServiceAccountKey.class);
        request.setKey(API_KEY);
        request.setFields(
                "keyAlgorithm,name,privateKeyData,privateKeyType,publicKeyData,validAfterTime,validBeforeTime");
        req.initializeJsonRequest(request);
        System.out.println(request.getRequestHeaders());
        return (T) request.execute();
    }

这篇关于我该如何为Google云端存储服务帐户的密钥进行轮换?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！