在 Python 中为 GCP 工作负载身份池生成凭据配置

gcloud iam workload-identity-pools create-cred-config \
projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$IDENTITY_POOL/providers/$IDENTITY_POOL_PROVIDER \
--service-account=$SA_EMAIL \
--output-file=$ClientConfig \
--aws

import os
import json
from google.auth.external_account import ExternalAccountCredentials
from google.cloud import storage # 以 Google Cloud Storage 客户端为例

# --- 1. 配置参数 (请替换为您的实际值) ---
# GCP 项目编号
PROJECT_NUMBER = "YOUR_GCP_PROJECT_NUMBER"
# 工作负载身份池 ID
IDENTITY_POOL = "YOUR_IDENTITY_POOL_ID"
# 工作负载身份池提供商 ID
IDENTITY_POOL_PROVIDER = "YOUR_IDENTITY_POOL_PROVIDER_ID"
# 要模拟的 GCP 服务账号的电子邮件地址
SERVICE_ACCOUNT_EMAIL = "your-service-account@your-gcp-project.iam.gserviceaccount.com"
# 外部凭据配置文件的输出路径 (如果需要生成文件)
OUTPUT_CONFIG_FILE = "gcp_aws_cred_config.json"

# --- 2. 构造 `audience` 和 `service_account_impersonation_url` ---
# audience 字符串，指示向哪个工作负载身份池提供商进行认证
audience = (
    f"//iam.googleapis.com/projects/{PROJECT_NUMBER}/locations/global/"
    f"workloadIdentityPools/{IDENTITY_POOL}/providers/{IDENTITY_POOL_PROVIDER}"
)

# 服务账号模拟 URL
service_account_impersonation_url = (
    f"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/"
    f"{SERVICE_ACCOUNT_EMAIL}:generateAccessToken"
)

# --- 3. 定义 `credential_source` 和其他相关参数 ---
# 对于 AWS，credential_source 字典描述了如何获取 AWS 临时凭据。
# google.auth.external_account 会自动检测 AWS 环境。
aws_credential_source_config = {
    "environment_id": "aws",
    # 如果在 EC2 实例上运行，这些 URL 用于获取实例元数据中的凭据。
    # 如果通过环境变量提供 AWS 凭据，这些字段并非严格必需，但包含它们
    # 可以使配置更完整，与 gcloud 生成的文件结构一致。
    # "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    # "region_url": "http://169.254.169.254/latest/meta-data/placement/region"
}

# 主题令牌类型，对于 AWS 联合身份是固定的
subject_token_type = "urn:ietf:params:oauth:token-type:aws-federated-token"

# GCP STS 令牌交换 URL
token_url = "https://sts.googleapis.com/v1/token"

# --- 4. 创建 ExternalAccountCredentials 对象 ---
try:
    credentials = ExternalAccountCredentials(
        token_url=token_url,
        credential_source=aws_credential_source_config,
        audience=audience,
        service_account_impersonation_url=service_account_impersonation_url,
        subject_token_type=subject_token_type
    )

    print("成功创建 ExternalAccountCredentials 对象。")

    # --- 5. 使用凭据访问 GCP 服务 (以 Google Cloud Storage 为例) ---
    # 确保您的运行环境已配置有效的 AWS 凭据 (例如，通过环境变量或 AWS CLI 配置)。
    storage_client = storage.Client(credentials=credentials, project=PROJECT_NUMBER)
    print("\n尝试列出 GCP Cloud Storage 存储桶...")
    buckets = list(storage_client.list_buckets())
    print("成功通过工作负载身份联合认证并列出存储桶：")
    for bucket in buckets:
        print(f"- {bucket.name}")

except Exception as e:
    print(f"在使用凭据时发生错误: {e}")
    print("请确保您的 AWS 凭据已正确配置（例如