cloudbuild with drive access_token

cloud_build_drive.md

snippet cloud build which uses imerpsonation to get a drive-enabled access token

uses a customer cloud build service account and impersonation

• https://docs.cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts

also see

• https://github.com/salrashid123/cosign_bazel_cloud_build
• https://github.com/salrashid123/cloud_build_slsa

export PROJECT=your-project

gcloud iam service-accounts add-iam-policy-binding  cicd-test-sa@$PROJECT.iam.gserviceaccount.com \
    --role roles/iam.serviceAccountTokenCreator \
    --member "serviceAccount:cicd-test-sa@$PROJECT.iam.gserviceaccount.com"

gcloud projects add-iam-policy-binding $PROJECT \
  --member=serviceAccount:cicd-test-sa@$PROJECT.iam.gserviceaccount.com  \
  --role=roles/logging.logWriter

gsutil mb gs://$PROJECT\_cloudbuild
gsutil iam ch  serviceAccount:cicd-test-sa@$PROJECT.iam.gserviceaccount.com:objectAdmin gs://$PROJECT\_cloudbuild

gcloud builds submit --config=cloudbuild.yaml

cat cloudbuild.yaml

steps:
- name: gcr.io/cloud-builders/gcloud
  id: getidtoken
  args: ['auth', 'print-identity-token', '--include-email', '--audiences', 'https://foo.com','--impersonate-service-account','cicd-test-sa@$PROJECT_ID.iam.gserviceaccount.com']
- name: gcr.io/cloud-builders/gcloud
  id: getaccesstoken
  args: ['auth', 'print-access-token', '--impersonate-service-account','cicd-test-sa@$PROJECT_ID.iam.gserviceaccount.com']
- name: gcr.io/cloud-builders/gcloud
  id: getdefaultadc
  args: ['auth', 'application-default', 'print-access-token', '--impersonate-service-account','cicd-test-sa@$PROJECT_ID.iam.gserviceaccount.com']
- name: gcr.io/cloud-builders/gcloud
  id: getadcwithdrive
  args: ['auth', 'application-default', 'print-access-token', '--impersonate-service-account','cicd-test-sa@$PROJECT_ID.iam.gserviceaccount.com','--scopes', 'https://www.googleapis.com/auth/drive.activity.readonly,https://www.googleapis.com/auth/userinfo.email']
serviceAccount: 'projects/$PROJECT_ID/serviceAccounts/cicd-test-sa@$PROJECT_ID.iam.gserviceaccount.com'
options:
  logging: CLOUD_LOGGING_ONLY

you can emit the drive-enabled token to a file under the shared /workspace directory and read and use it with any cloud Static token source

---

$ curl -s https://www.googleapis.com/oauth2/v2/tokeninfo?access_token=$TOKEN
{
  "issued_to": "102752075963180168574",
  "audience": "102752075963180168574",
  "scope": "email https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/drive.activity.readonly",
  "expires_in": 3548,
  "email": "cicd-test-sa@$PROJECT.iam.gserviceaccount.com",
  "verified_email": true,
  "access_type": "online"
}