Currently asks the user for edit and delete permissions across the entirety of GCP.
For our purposes, we only need read access to google cloud storage. Suggest changing auth scope here:
|
scopes = "https://www.googleapis.com/auth/cloud-platform", |
One issue is that auth is used to verify a user, not set permission levels for a session. That has some implications:
- When you verify yourself, you get access to cloud objects and services depending on the level of access set for yourself
- On our cloud storage buckets, you are all permissioned as "Storage Object Viewers" which means that you can read and download the data in the buckets, but you can't upload anything, create new buckets or delete anything from our buckets.
- However, you might have higher level permission to interact with other cloud objects and services, such as your personal storage buckets.
- Since google has verified that you are who you say you are, in theory you can interact with anything you have access to on GCP in a colab session
- In a worst-case scenario, a malicious user could push a colab notebook to github that did something nefarious, such as deleting something else you had access to
Not sure how to design that out. But I guess the lesson is to take note of those Colab warnings about "this notebook was not authored by google, be careful...."
Currently asks the user for edit and delete permissions across the entirety of GCP.
For our purposes, we only need read access to google cloud storage. Suggest changing auth scope here:
rwRtools/R/rwlab_lab_auth.R
Line 44 in 0696601
One issue is that auth is used to verify a user, not set permission levels for a session. That has some implications:
Not sure how to design that out. But I guess the lesson is to take note of those Colab warnings about "this notebook was not authored by google, be careful...."