Authenticating a Google Cloud Function as a service account on other Google APIs

Question

I have an HTTP-triggered function running on Google Cloud Functions, which uses require('googleapis').sheets('v4') to write data into a docs spreadsheet.

For local development I added an account via the Service Accounts section of their developer console. I downloaded the token file (dev-key.json below) and used it to authenticate my requests to the Sheets API as follows:

var API_ACCT = require("./dev-key.json");
let apiClient = new google.auth.JWT(
  API_ACCT.client_email, null, API_ACCT.private_key,
  ['https://www.googleapis.com/auth/spreadsheets']
);

exports.myFunc = function (req, res) {
  var newRows = extract_rows_from_my_client_app_request(req);
  sheets.spreadsheets.values.append({
    auth: apiClient,
    // ...
    resource: { values:newRows }
  }, function (e) {
    if (e) res.status(500).json({err:"Sheets API is unhappy"});
    else res.status(201).json({ok:true})
  });
};

After I shared my spreadsheet with my service account's "email address" e.g. [email protected] — it worked!

However, as I go to deploy this to the Google Cloud Functions service, I'm wondering if there's a better way to handle credentials? Can my code authenticate itself automatically without needing to bundle a JWT key file with the deployment?

I noticed that there is a FUNCTION_IDENTITY=foobar-bazbuzz-123456@appspot.gserviceaccount.com environment variable set when my function runs, but I do not know how to use this in the auth value to my googleapis call. The code for google.auth.getApplicationDefault does not use that.

Is it considered okay practice to upload a private JWT token along with my GCF code? Or should I somehow be using the metadata server for that? Or is there a built-in way that Cloud Functions already can authenticate themselves to other Google APIs?

Answer 1

It's common to bundle credentials with a function deployment. Just don't check them into your source control. Cloud Functions for Firebase samples do this where needed. For example, creating a signed URL from Cloud Storage requires admin credentials, and this sample illustrates saving that credential to a file to be deployed with the functions.