I have a CLI tool that interacts with Google KMS. In order for it to work, I fetch the user credentials as a JSON file which is stored on disk. Now a new requirement came along. I need to make a web app out of this CLI tool. The web app will be protected via Google Cloud IAP. Question is, how do I run the CLI tool on behalf of the authenticated user?
Using Google Cloud KMS on behalf of user
202 Views Asked by Liviu At
1
There are 1 best solutions below
Related Questions in GOOGLE-CLOUD-PLATFORM
- Google Logging API - What service name to use when writing entries from non-Google application?
- Custom exception message from google endpoints exception
- Unable to connect database of lamp instance from servlet running on tomcat instance of google cloud
- How to launch a Jar file using Spark on hadoop
- Google Cloud Bigtable Durability/Availability Guarantees
- How do I add a startup script to an existing VM from the developer console?
- What is the difference between an Instance and an Instance group
- How do i change files using ftp in google cloud?
- How to update all machines in an instance group on Google Cloud Platform?
- Setting up freeswitch server on Google cloud compute
- Google Cloud Endpoints: verifyToken: Signature length not correct
- Google Cloud BigTable connection setup time
- How GCE HTTP Cross-Region Load Balancing implemented
- Google Cloud Bigtable compression
- Google cloud SDK code to execute via cron
Related Questions in GOOGLE-CLOUD-KMS
- Google's Key Management System: data unencryption after key rotation
- IllegalAccessError: tried to access field com.google.protobuf.AbstractMessage.memoizedSize while using KMS decrypt
- Using Google Cloud KMS on behalf of user
- nested exception is java.lang.NoClassDefFoundError: Could not initialize class com.google.cloud.kms.v1.stub.GrpcKeyManagementServiceStub
- How to get a valid and deterministic signature and recover the address of an Ethereum transaction using GCP KMS?
- Caused by: com.google.apphosting.api.ApiProxy$FeatureNotEnabledException: app_identity_service.GetAccessToken
- How to pass the key version when creating key ( Symmetric/ Asymmetric) in GCP KMS
- DataFlow job failed with Caused by: io.grpc.StatusRuntimeException: NOT_FOUND: Requested deidentify
- Data encryption - Multi region
- Can we save wrapped keys generated with cloud KMS keys in DLP deidentification templates(using Python Api)?
- Convert Google KMS signatures from DER-encoded format to .Net IEEE 1363 format
- How to mock @google-cloud/kms using jest
- Uploading Custom Private Keys for use in Google Cloud KMS
- (gcloud.kms.encrypt) Failed to read plaintext file
- Google Cloud Cloud/Key activity logging
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
You don't. Better use a service-account and assign the required role. That service account still could have domain-wide delegation of rights (able to impersonate just any user, which is known).
Running CLI tools from a web-application probably also could/should be avoided. Iit might be better to convert his CLI tool into a Cloud Function and then call it via HTTP trigger, from within the web-application (so that access to the service account is limited as far as possible).
This might also be something to reconsider, security-wise:
Even if it might have been required, with a service-account it wouldn't.