如何使用nodeJS将订户角色和发布者角色添加到Google Cloud pubsub的死信中? [英] How to add subscriber role and publisher role to deadletter for google cloud pubsub using nodeJS?

问题描述

我们一直在关注

We've been following https://cloud.google.com/pubsub/docs/dead-letter-topics and nodeJS client to create, update our pubsub topics and subscriptions but after following:

async function createSubscriptionWithDeadLetterPolicy() {
  // Creates a new subscription
  await pubSubClient.topic(topicName).createSubscription(subscriptionName, {
    deadLetterPolicy: {
      deadLetterTopic: pubSubClient.topic(deadLetterTopicName).name,
      maxDeliveryAttempts: 10,
    },
  });
  console.log(
    `Created subscription ${subscriptionName} with dead letter topic ${deadLetterTopicName}.`
  );
  console.log(
    'To process dead letter messages, remember to add a subscription to your dead letter topic.'
  );
}

We get this in the dead-letter

This Suggests running the command in CLI for each dead-letter but we don't want to do it manually for each subscription is there a way to do this in nodeJS client itself? Or doing so for all the subscriptions once and for all even for the new subscriptions that will be created in given project later on.

解决方案

According to this part of the documentation, you need to grant 2 roles to the PubSub service agent service account. And of course, you can do it by API calls. And, it's not so easy!

In fact, it's not difficult, just boring! Why? Because, you can't only "add" a policy, you set the whole policies. To achieve this:

• Get all the existing policies
• Add your policy in the existing list
• Submit the new list of policies.

You need to do this:

• Either globally by setting the policies at the project level. Easier but less secure (break the least privilege principle)
• Or on each Dead Letter topic and on each subscription with Dead Letter set up.

You have code example in the Client library doc

---

EDIT1

If you script the grant access mechanism, you don't care to find it or not: it exists, that's all! Maybe you don't view it on the console, but it exists. Only the pattern is important:

service-<project-number>@gcp-sa-pubsub.iam.gserviceaccount.com

If you are looking for it on the console, it's tricky now! You have to go to Access -> IAM. And then click on the check box on the top rigth corner to display the Google technical accounts

这篇关于如何使用nodeJS将订户角色和发布者角色添加到Google Cloud pubsub的死信中?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！