0

I'm trying to incorporate Secret Manager with my projects for security but running into issues setting it up. I currently have a service account in project-b where I downloaded the JSON credential keys and have been using that to access my BigQuery table in my backend code.

My current setup:

I have project-a that uses Cloud Run to host my code.

I have project-b that uses BigQuery to hold some data for me.

From project-a, I'm trying to access the BigQuery table in project-b just like I've been doing with the JSON keys.

I keep running into this error:

PermissionDenied: 403 Permission 'secretmanager.versions.access' denied for resource 'projects/project-b/secrets/stockdata-secret/versions/1' (or it may not exist).

I have assigned the Secret Manager Secret Accessor and Secret Manager Viewer roles to a couple of my accounts but it still doesn't seem to work.

The client_email from the keys is set to the top service account in the screenshot below:

Permissions for the secret

Here is my part of my back-end code:

# Grabbing keys from Secret Manager, got this code from Google docs
def access_secret_version(project_id, secret_id, version_id):

    # Create the Secret Manager client.
    client = secretmanager.SecretManagerServiceClient()

    # Build the resource name of the secret version.
    name = f"projects/{project_id}/secrets/{secret_id}/versions/{version_id}"

    # Access the secret version.
    response = client.access_secret_version(request={"name": name})

    payload = response.payload.data.decode("UTF-8")
    return payload

---
# Routing to the page
@app.route('/projects/random-page')
def random_page():
    payload = access_secret_version("project-b", "stockdata-secret", "1")

    # Authenticating service account.
    os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = payload

    # old way, which worked
    google_cloud_service_account = "creds.json"
    os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = google_cloud_service_account
scarecrow
  • 29
  • 3
  • Your cloud run code is being executed under some service account - https://cloud.google.com/run/docs/configuring/service-accounts That happens in your project 'A'. Can you grant that service account relevant IAM roles (see https://cloud.google.com/bigquery/docs/control-access-to-resources-iam#grant_access_to_a_resource) in the project 'B' to access desired BigQuery tables in that project 'B'? As a result - you won't need to work with the Secret Manager at all, and you won't need any credentials to be stored somewhere. – al-dann Jan 10 '23 at 20:49
  • @al-dann - I can take a look into that. I am still curious though why this isn't working. I'm not sure if I am creating the secret in the correct project. – scarecrow Jan 10 '23 at 20:59
  • From the best of my understanding of your description/context - there is not need for any secrets at all. – al-dann Jan 10 '23 at 21:09

0 Answers0