IAM
floci-gcp emulates Google Cloud IAM over REST JSON using the real GCP IAM API.
Configuration
| Variable | Default | Description |
|---|---|---|
FLOCI_GCP_SERVICES_IAM_ENABLED |
true |
Enable/disable IAM |
Quick Start
gcloud config set project floci-local
# Create a service account
gcloud iam service-accounts create my-sa \
--display-name="My Service Account"
# List service accounts
gcloud iam service-accounts list
# Create a key
gcloud iam service-accounts keys create key.json \
--iam-account=my-sa@floci-local.iam.gserviceaccount.com
# Delete a key
gcloud iam service-accounts keys delete KEY_ID \
--iam-account=my-sa@floci-local.iam.gserviceaccount.com
# Create service account
curl -X POST http://localhost:4588/v1/projects/floci-local/serviceAccounts \
-H "Content-Type: application/json" \
-d '{"accountId":"my-sa","serviceAccount":{"displayName":"My SA"}}'
# List service accounts
curl http://localhost:4588/v1/projects/floci-local/serviceAccounts
# Get service account
curl http://localhost:4588/v1/projects/floci-local/serviceAccounts/my-sa@floci-local.iam.gserviceaccount.com
# Delete service account
curl -X DELETE http://localhost:4588/v1/projects/floci-local/serviceAccounts/my-sa@floci-local.iam.gserviceaccount.com
Service Accounts
Service accounts follow the GCP naming convention:
Service Account Keys
# Create key
curl -X POST \
http://localhost:4588/v1/projects/floci-local/serviceAccounts/my-sa@floci-local.iam.gserviceaccount.com/keys \
-H "Content-Type: application/json" \
-d '{}'
# List keys
curl http://localhost:4588/v1/projects/floci-local/serviceAccounts/my-sa@floci-local.iam.gserviceaccount.com/keys
IAM Policy Bindings
# Grant Secret Manager access to a service account
gcloud secrets add-iam-policy-binding my-secret \
--member="serviceAccount:my-sa@floci-local.iam.gserviceaccount.com" \
--role="roles/secretmanager.secretAccessor"
Sign Blob (V4 Signed URLs)
The IAM SignBlob endpoint is used by the GCS SDK to generate V4 pre-signed URLs:
URL signedUrl = storage.signUrl(
BlobInfo.newBuilder("my-bucket", "hello.txt").build(),
15, TimeUnit.MINUTES,
Storage.SignUrlOption.withV4Signature());
SignBlob accepts the bytes to sign and returns a stub signature, which is sufficient for local development.
Supported Operations
CreateServiceAccountGetServiceAccountListServiceAccountsDeleteServiceAccountCreateServiceAccountKey(real RSA-2048 key pair; returns JSON key file)GetServiceAccountKeyListServiceAccountKeysDeleteServiceAccountKeyGetIamPolicySetIamPolicyTestIamPermissionsSignBlob