Is there a way to use gsutil while impersonating a service account?

Question

I am in the process of attempting to adjust user permissions in Google Cloud and have created a service account that other users can impersonate to access various projects. The gcloud command has the --impersonate-service-account option to make API calls with the proper authentication, but I was wondering if anyone knows how to make such calls using gsutil.

Here's an example of what a successful call looks like using gcloud:

gcloud --impersonate-service-account=superuser@PROJECT1.iam.gserviceaccount.com iam service-accounts list --project PROJECT2

Answer 1

Yes, here's the option:

$ gsutil -i [SERVICE-ACCOUNT]@[PROJECT] [GSUTIL-COMMAND]

Example:

$ gsutil -i [email protected] ls

Answer 2

There is no such option in the top-level gsutil command-line options (at least not a documented one).

By contrast the gcloud --impersonate-service-account is documented.

Things to try:

• if you use the gsutil distributed with the gcloud SDK - it has some ability to use the credentials established by gcloud auth, see Configuring/Using Credentials Via Cloud Sdk Distribution Of Gsutil
• if you use the standalone version, check the gsutil config command, which should allow specifying a service account credentials (see also Updating To The Latest Configuration File):

-e Prompt for service account credentials. This option requires that -a is not set.