Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add OAuth2 token support for GCS backend #21772

Merged
merged 6 commits into from
Sep 25, 2019
Merged

Add OAuth2 token support for GCS backend #21772

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f6c90c1
Add OAuth2 token support for GCS backend
Jun 18, 2019
0aae628
update version
Jul 5, 2019
f22c923
Revert "update version"
Jul 5, 2019
3f56a7f
bump version
Aug 13, 2019
f9ee002
Merge pull request #1 from kostas-theo/21680/GCS_OAUTH
luis-silva Aug 13, 2019
9ae8eca
Merge branch 'master' into 21680/GCS_OAUTH
luis-silva Aug 27, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions backend/remote-state/gcs/backend.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
"github.com/hashicorp/terraform/helper/pathorcontents"
"github.com/hashicorp/terraform/helper/schema"
"github.com/hashicorp/terraform/httpclient"
"golang.org/x/oauth2"
"golang.org/x/oauth2/jwt"
"google.golang.org/api/option"
)
Expand Down Expand Up @@ -65,6 +66,15 @@ func New() backend.Backend {
Default: "",
},

"access_token": {
Type: schema.TypeString,
Optional: true,
DefaultFunc: schema.MultiEnvDefaultFunc([]string{
"GOOGLE_OAUTH_ACCESS_TOKEN",
}, nil),
Description: "An OAuth2 token used for GCP authentication",
},

"encryption_key": {
Type: schema.TypeString,
Optional: true,
Expand Down Expand Up @@ -116,12 +126,23 @@ func (b *Backend) configure(ctx context.Context) error {

var opts []option.ClientOption

creds := data.Get("credentials").(string)
if creds == "" {
// Add credential source
var creds string
var tokenSource oauth2.TokenSource

if v, ok := data.GetOk("access_token"); ok {
tokenSource = oauth2.StaticTokenSource(&oauth2.Token{
AccessToken: v.(string),
})
} else if v, ok := data.GetOk("credentials"); ok {
creds = v.(string)
} else {
creds = os.Getenv("GOOGLE_CREDENTIALS")
}

if creds != "" {
if tokenSource != nil {
opts = append(opts, option.WithTokenSource(tokenSource))
} else if creds != "" {
var account accountFile

// to mirror how the provider works, we accept the file path or the contents
Expand Down
3 changes: 3 additions & 0 deletions website/docs/backends/types/gcs.html.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,9 @@ The following configuration options are supported:
* `credentials` / `GOOGLE_CREDENTIALS` - (Optional) Local path to Google Cloud Platform account credentials in JSON format.
If unset, [Google Application Default Credentials](https://developers.google.com/identity/protocols/application-default-credentials) are used.
The provided credentials need to have the `devstorage.read_write` scope and `WRITER` permissions on the bucket.
* `access_token` - (Optional) A temporary [OAuth 2.0 access token] obtained from
the Google Authorization server, i.e. the `Authorization: Bearer` token used to
authenticate HTTP requests to GCP APIs. This is an alternative to `credentials`. If both are specified, `access_token` will be used over the `credentials` field.
* `prefix` - (Optional) GCS prefix inside the bucket. Named states for workspaces are stored in an object called `<prefix>/<name>.tfstate`.
* `path` - (Deprecated) GCS path to the state file of the default state. For backwards compatibility only, use `prefix` instead.
* `encryption_key` / `GOOGLE_ENCRYPTION_KEY` - (Optional) A 32 byte base64 encoded 'customer supplied encryption key' used to encrypt all state. For more information see [Customer Supplied Encryption Keys](https://cloud.google.com/storage/docs/encryption#customer-supplied).