Support service account impersonation (Closes #248)

[xanonid]

Closes: #248

[LalitLab]

@xanonid
Thank you for contribution.

Can you help me to test the service account impersonation capability for the plugin?
Below is what I have tried so far to test it.

• Created a service account having owner access to the project
• Now I have granted Service Account User role to the user on the above-created service account
• Then I have created ADC credentials for the user using gcloud auth application-default login
  where I got below warning

WARNING: 
Cannot add the project "xxxxxxx-aaa" to ADC as the quota project because the account in ADC does not have the "serviceusage.services.use" permission on this project. You might receive a "quota_exceeded" or "API not enabled" error. 

On running below query in steampipe I am getting error:

> select * from gcp.gcp_storage_bucket
Error: Get "https://storage.googleapis.com/storage/v1/b?alt=json&prettyPrint=false&project=xxxxxxx-aaa": impersonate: status code 403: {
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}

[xanonid]

Hi @LalitTurbot,

thanks for your reply. You can test the impersonation directly with gcloud using the corresponding flag:
gcloud --impersonate-service-account=YOUR_SERVICE_ACCOUNT@PROJECT.iam.gserviceaccount.com alpha storage ls

You need the roles/iam.serviceAccountTokenCreator role. The roles/​iam.serviceAccountUser role is not enough.

Here is a lengthy description for the needed steps.

[LalitLab]

Hi @LalitTurbot,

thanks for your reply. You can test the impersonation directly with gcloud using the corresponding flag:
gcloud --impersonate-service-account=YOUR_SERVICE_ACCOUNT@PROJECT.iam.gserviceaccount.com alpha storage ls

You need the roles/iam.serviceAccountTokenCreator role. The roles/​iam.serviceAccountUser role is not enough.

Here is a lengthy description for the needed steps.

Thanks, it worked after granting iam.serviceAccountTokenCreator to the user on the service account.

[LalitLab]

LGTM

[cbruno10]

@xanonid Thanks again for the contribution!