Documentation
¶
Overview ¶
Package gcp provides GCP SDK helpers for simulation packs.
Index ¶
- Constants
- func CleanupCredentials(credentialsPath string) error
- func ClientOptions(ctx context.Context) ([]option.ClientOption, error)
- func Credentials(ctx context.Context) (*google.Credentials, error)
- func ImpersonateServiceAccount(ctx context.Context, serviceAccountEmail string, scopes []string) (option.ClientOption, error)
- func InitCredentials() (string, error)
Constants ¶
const ( // CredentialsEnvVar is the environment variable for GCP credentials JSON. CredentialsEnvVar = "SR_GCP_CREDENTIALS" // CredentialsFileEnvVar is the environment variable for GCP credentials file path. CredentialsFileEnvVar = "SR_GCP_CREDENTIALS_FILE" // GoogleApplicationCredentialsEnvVar is the standard GCP SDK environment variable. GoogleApplicationCredentialsEnvVar = "GOOGLE_APPLICATION_CREDENTIALS" )
Variables ¶
This section is empty.
Functions ¶
func CleanupCredentials ¶
CleanupCredentials removes the temporary credentials file if it was created by InitCredentials.
func ClientOptions ¶
func ClientOptions(ctx context.Context) ([]option.ClientOption, error)
ClientOptions returns Google Cloud client options using standard environment variables. Supported environment variables:
- GOOGLE_CREDENTIALS: JSON credentials string
- GOOGLE_APPLICATION_CREDENTIALS: Path to credentials JSON file
If neither is set, uses Application Default Credentials.
func Credentials ¶
func Credentials(ctx context.Context) (*google.Credentials, error)
Credentials returns the default GCP credentials for the current environment.
func ImpersonateServiceAccount ¶
func ImpersonateServiceAccount(ctx context.Context, serviceAccountEmail string, scopes []string) (option.ClientOption, error)
ImpersonateServiceAccount returns a client option that uses impersonated credentials for the specified service account. This allows simulations to test privilege escalation scenarios by attempting operations with limited permissions.
The caller must have the iam.serviceAccountTokenCreator role on the target service account.
func InitCredentials ¶
InitCredentials checks for GCP credentials environment variables and sets up GOOGLE_APPLICATION_CREDENTIALS to point to a credentials file.
Returns the path to the credentials file if created, empty string if no credentials were found, or an error if the credentials are invalid or cannot be written.
Types ¶
This section is empty.
Source Files