gsutil config -a. Which key to use?

Question

There are so many keys to be created for use with Google Compute Cloud. I'm trying to create .boto file using gsutil and it's asking for "Google access key ID". My goal is to script access to "Google Cloud Storage" using Python.

So, when gsutil is asking for "Google access key ID" - is it the one from

• Credentials->Service account keys? or
• Credentials->OAuth 2.0 client IDs? or
• Credentials->API keys?

Doordie

Answer 1

gsutil config -a lets you use HMAC-style access keys. These aren't service account keys; if you want to use a service account you should use gsutil config -e. But if you really did want to use HMAC keys, you can get them from https://console.cloud.google.com/storage/settings, then click on "Interoperability". From there you can create an access key if you don't already have one, and you can copy/paste the access key and secret that you need to enter with gsutil config -a.

Pinero

it doesn't let me to use "-e" option. It's either "gcloud auth login" or "gsutil config -a" – Doordie

I am crazy from this too. But I think: – Rundell

1. command is "gsutil config" (without -a) 2. it will give link; follow the link and copy/paste the string back to terminal/gsutil prompt 3. next link should lead you to console.cloud.google.com/cloud-resource-manager where you have your (already created) projects in 2 columns: Project Name, Project ID; copy Project ID back into terminal/gsutil. Finished. Now you have ~/.boto file (used later by gsutil) with just single ID: Project ID – Rundell

Is not working anymore: CommandException: The user account authentication flow no longer works as of Febuary 1, 2023. Tokens generated before this date will continue to work. To authenticate with your user account, install gsutil via Cloud SDK and run "gcloud auth login" – Cosecant

Answer 2

Use service account to solve this problem.

gcloud auth activate-service-account --key-file json_file

Holystone

Answer 3

It's second option

• Credentials->OAuth 2.0 client IDs

For Cloud Storage API access I have to use OAuth2 because I access user data.

If I had to access Translate API I'd use API Key because no user data access required.

Docs are here.

Doordie