google_service_account_key resource
Syntax
A google_service_account_key
is used to test a Google ServiceAccountKey resource
Examples
google_service_account_keys(project: 'chef-gcp-inspec', service_account: "display-name@project-id.iam.gserviceaccount.com").key_names.each do |sa_key_name|
describe google_service_account_key(project: 'chef-gcp-inspec', service_account: "display-name@project-id.iam.gserviceaccount.com", name: sa_key_name.split('/').last) do
it { should exist }
its('key_type') { should_not cmp 'USER_MANAGED' }
end
end
Test that a GCP project IAM service account key has the expected key algorithm
describe google_service_account_key(name: "projects/sample-project/serviceAccounts/test-sa@sample-project.iam.gserviceaccount.com/keys/c6bd986da9fac6d71178db41d1741cbe751a5080" ) do
its('key_algorithm') { should eq "KEY_ALG_RSA_2048" }
end
Properties
Properties that can be accessed from the google_service_account_key
resource:
name
- The name of the key.
private_key_type
- Output format for the service account key.
Possible values:
- TYPE_UNSPECIFIED
- TYPE_PKCS12_FILE
- TYPE_GOOGLE_CREDENTIALS_FILE
key_algorithm
- Specifies the algorithm for the key.
Possible values:
- KEY_ALG_UNSPECIFIED
- KEY_ALG_RSA_1024
- KEY_ALG_RSA_2048
private_key_data
- Private key data. Base-64 encoded.
public_key_data
- Public key data. Base-64 encoded.
valid_after_time
- Key can only be used after this time.
valid_before_time
- Key can only be used before this time.
key_type
- Specifies the type of the key.
Possible values:
- KEY_TYPE_UNSPECIFIED
- USER_MANAGED
- SYSTEM_MANAGED
service_account
- The name of the serviceAccount.
path
- The full name of the file that will hold the service account private key. The management of this file will depend on the value of sync_file parameter. File path must be absolute.
GCP Permissions
Ensure the Identity and Access Management (IAM) API is enabled for the current project.