GCP 中的秘密管理器权限问题

Question

我目前正在GCP云函数中开发一个简单的代码。

问题是我需要连接到秘密管理器才能获取 api 密钥。

在 jupyter 中，这段代码非常适合我：

def access_secret_version(secret_id):
    project_id = os.getenv("GCP_PROJECT", "My_Project")
    name = f"projects/{project_id}/secrets/{secret_id}/versions/1"
    response = secret_client.access_secret_version(request={"name": name})
    response = response.payload.data.decode("UTF-8")
    return json.loads(response.replace("'", '"'))


ACCESS_TOKEN = access_secret_version("api_key")

但是当我通过 CI/CD 部署它时，它会抛出这个错误：

"message": "Function failed on loading user code. This is likely due to a bug in the user code. Error message:   File \"<frozen importlib._bootstrap_external>\", line 995, in exec_module
  File \"<frozen importlib._bootstrap>\", line 488, in _call_with_frames_removed
  File \"/workspace/main.py\", line 40, in <module>
    ACCESS_TOKEN = access_secret_version(\"api_key\")
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/workspace/main.py\", line 35, in access_secret_version
    response = secret_client.access_secret_version(request={\"name\": name})
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/cloud/secretmanager_v1/services/secret_manager_service/client.py\", line 1800, in access_secret_version
    response = rpc(
               ^^^^
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/gapic_v1/method.py\", line 131, in __call__
    return wrapped_func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_unary.py\", line 293, in retry_wrapped_func
    return retry_target(
           ^^^^^^^^^^^^^
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_unary.py\", line 153, in retry_target
    _retry_error_helper(
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_base.py\", line 212, in _retry_error_helper
    raise final_exc from source_exc
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/retry/retry_unary.py\", line 144, in retry_target
    result = target()
             ^^^^^^^^
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/timeout.py\", line 120, in func_with_timeout
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File \"/layers/google.python.pip/pip/lib/python3.12/site-packages/google/api_core/grpc_helpers.py\", line 78, in error_remapped_callable
    raise exceptions.from_grpc_error(exc) from exc
google.api_core.exceptions.PermissionDenied: 403 Permission 'secretmanager.versions.access' denied for resource 'projects/project/secrets/api_key/versions/latest' (or it may not exist).. Please visit https://cloud.google.com/functions/docs/troubleshooting for in-depth troubleshooting documentation."

我的用户和帐户服务具有相同的角色，并且我已经授予帐户服务管理员访问秘密管理器、秘密版本等的权限。

我也已经验证了秘密管理器中存在密钥

有人可以帮我解决这个问题吗？或者我应该向帐户服务授予什么权限？

Answer 1

您还可以将机密作为环境变量传递给云函数，而不是使用 python 客户端库来检索机密。

服务帐户（显示在函数的“详细信息”选项卡中）仍需要具有

roles/secretmanager.secretAccessor

角色。在您的情况下，如果给了正确的服务帐户，Secret Manager 管理员就可以访问它。