Skip to content

feat: add gcp_credentials_path argument (#147) #531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: add gcp_credentials_path argument (#147) #531

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions postgresql/provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,13 @@ func Provider() *schema.Provider {
Description: "Service account to impersonate when using GCP IAM authentication.",
},

"gcp_credentials_path": {
Type: schema.TypeString,
Optional: true,
Default: "",
Description: "Path to GCP credentials file",
},

// Connection username can be different than database username with user name maps (e.g.: in Azure)
// See https://www.postgresql.org/docs/current/auth-username-maps.html
"database_username": {
Expand Down Expand Up @@ -286,7 +293,13 @@ func getRDSAuthToken(region string, profile string, role string, username string
return token, err
}

func createGoogleCredsFileIfNeeded() error {
func createGoogleCredsFileIfNeeded(gcpCredentialsPath string) error {
const GoogleCredentialsEnvVar = "GOOGLE_APPLICATION_CREDENTIALS"

if gcpCredentialsPath != "" {
return os.Setenv(GoogleCredentialsEnvVar, gcpCredentialsPath)
}

if _, err := google.FindDefaultCredentials(context.Background()); err == nil {
return nil
}
Expand All @@ -307,7 +320,7 @@ func createGoogleCredsFileIfNeeded() error {
return fmt.Errorf("could not write in temporary file: %w", err)
}

return os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", tmpFile.Name())
return os.Setenv(GoogleCredentialsEnvVar, tmpFile.Name())
}

func acquireAzureOauthToken(tenantId string) (string, error) {
Expand Down Expand Up @@ -395,7 +408,7 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
}

if config.Scheme == "gcppostgres" {
if err := createGoogleCredsFileIfNeeded(); err != nil {
if err := createGoogleCredsFileIfNeeded(d.Get("gcp_credentials_path").(string)); err != nil {
return nil, err
}
}
Expand Down
3 changes: 2 additions & 1 deletion website/docs/index.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,7 @@ The following arguments are supported:
* `aws_rds_iam_provider_role_arn` - (Optional) AWS IAM role to assume while using AWS RDS IAM Auth.
* `azure_identity_auth` - (Optional) If set to `true`, call the Azure OAuth token endpoint for temporary token
* `azure_tenant_id` - (Optional) (Required if `azure_identity_auth` is `true`) Azure tenant ID [read more](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config.html)
* `gcp_credentials_path` - (Optional) The path to the GCP credentials file. This is only used if `scheme` is set to `gcppostgres`.

## GoCloud

Expand All @@ -212,7 +213,7 @@ provider "postgresql" {

To enable GoCloud for GCP SQL, set `scheme` to `gcppostgres` and `host` to the connection name of the instance in following format: `project/region/instance` (or `project:region:instance`).

For GCP, GoCloud also requires the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to be set to the service account credentials file.
For GCP, GoCloud also requires the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to be set to the service account credentials file. In alternative, you could set `gcp_credentials_path` to the credentials file.
These credentials can be created here: https://console.cloud.google.com/iam-admin/serviceaccounts

In addition, the provider supports service account impersonation with the `gcp_iam_impersonate_service_account` option. You must ensure:
Expand Down