Securing service account keys

[paulowe]

I am using the Google API discovery module to build a gmail api that fetches some labels from my inbox using Google Cloud Functions. 

- https://googleapis.github.io/google-api-python-client/docs/epy/googleapiclient.discovery-module.html 

- https://developers.google.com/discovery

As part of the parameters, I am passing service account key credentials in json format like this:

credentials = service_account.Credentials.from_service_account_file(f'/tmp/path-to-keys.json}', scopes=scopes)

delegated_credentials = credentials.with_subject(USER_EMAIL)

service = discovery.build(api_name, api_version, cache_discovery=False, credentials=delegated_credentials)

return service

My current solution fetches  the SA keys from a cloud storage bucket. I am concerned about the security and management of service account keys and was thinking about enhancing the solution to store the keys in Secret manager instead. However, I found out that this is also not a best practice.

- https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys#secret-manager 

I am curious to learn about people's opinions on this and whether there is a more robust way of implementation.

Thanks!

[kolban · Accepted solution]

If I am reading the post correctly, I am sensing that the call to gmail is happening from Cloud Functions.  Your Cloud Function service is running under the auspicies of a Service Account already.  If it were me, I'd be looking to create a Service Account that your Cloud Function runs as that you then give authorization to call gmail.  When your Cloud Function then calls gmail, you will already be implicitly authorized for gmail.  There are no keys involved at all ... only configuration of the environment.