サービスアカウントの権限を借用してアプリケーションのデフォルト認証情報を設定する

$ gcloud iam service-accounts create test-bq-admin
Created service account [test-bq-admin].
$ gcloud projects add-iam-policy-binding {プロジェクトID} \
	  --member="serviceAccount:test-bq-admin@{プロジェクトID}.iam.gserviceaccount.com" \
	  --role="roles/bigquery.admin"

$ gcloud iam service-accounts create test-storage-admin
Created service account [test-storage-admin].
$ gcloud projects add-iam-policy-binding {プロジェクトID} \
	  --member="serviceAccount:test-storage-admin@{プロジェクトID}.iam.gserviceaccount.com" \
	  --role="roles/storage.admin"

$ gcloud projects add-iam-policy-binding {プロジェクトID} \
    --member="user:ユーザーのメールアドレス" --role="roles/iam.serviceAccountTokenCreator"

from pprint import pprint
from google.cloud import storage
import google.auth
import google.auth.transport.requests

def print_default_credentials_info():
    credentials, project = google.auth.default()
    print("credentials:")
    pprint(vars(credentials))
    print(f"project:{project}")

def print_buckets():
    client = storage.Client()
    print("Bucket情報:")
    for bucket in client.list_buckets():
        print(bucket.name)

# メイン処理
if __name__ == "__main__":
    print_default_credentials_info()
    print_buckets()

$ gcloud auth application-default login --impersonate-service-account test-storage-admin@{プロジェクトID}.iam.gserviceaccount.com

$ cat ~/.config/gcloud/application_default_credentials.json
{
  "delegates": [],
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/test-storage-admin@{プロジェクトID}.iam.gserviceaccount.com:generateAccessToken",
  "source_credentials": {
    "account": "",
    "client_id": "xxxxxx-yyyyyyyyyyyy.apps.googleusercontent.com",
    "client_secret": "d-xxxxxxxxxxxxxxxxxxxxx",
    "refresh_token": "1//xxxxxxxxxxxxxxxxxxxxx-yyyyyyyyyyyyyyyyy",
    "type": "authorized_user",
    "universe_domain": "googleapis.com"
  },
  "type": "impersonated_service_account"
}

$ python gcs_list_bucket.py
credentials:
{'_default_scopes': None,
 '_delegates': [],
 '_iam_endpoint_override': None,
 '_lifetime': 3600,
 '_quota_project_id': None,
 '_scopes': None,
 '_source_credentials': <google.oauth2.credentials.Credentials object at 0x10f823490>,
 '_target_principal': 'test-storage-admin@{プロジェクトID}.iam.gserviceaccount.com',
 '_target_scopes': None,
 'expiry': datetime.datetime(2024, 8, 31, 21, 56, 9, 380857),
 'token': None}
project:{プロジェクトID}
Bucket情報:
aaaaaaaa-bucket
bbbbbbbb-bucket
cccccccc-bucket

$ gcloud auth application-default login --impersonate-service-account test-bq-admin@{プロジェクトID}.iam.gserviceaccount.com
$ cat ~/.config/gcloud/application_default_credentials.json
{
  "delegates": [],
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/test-bq-admin@{プロジェクトID}.iam.gserviceaccount.com:generateAccessToken",
  "source_credentials": {
    "account": "",
    "client_id": "xxxxxx-yyyyyyyyyyyy.apps.googleusercontent.com",
    "client_secret": "d-xxxxxxxxxxxxxxxxxxxxx",
    "refresh_token": "1//xxxxxxxxxxxxxxxxxxxxx-yyyyyyyyyyyyyyyyy",
    "type": "authorized_user",
    "universe_domain": "googleapis.com"
  },
  "type": "impersonated_service_account"
}

$ credentials:
{'_default_scopes': None,
 '_delegates': [],
 '_iam_endpoint_override': None,
 '_lifetime': 3600,
 '_quota_project_id': None,
 '_scopes': None,
 '_source_credentials': <google.oauth2.credentials.Credentials object at 0x11a337ad0>,
 '_target_principal': 'test-bq-admin@{プロジェクトID}.iam.gserviceaccount.com',
 '_target_scopes': None,
 'expiry': datetime.datetime(2024, 8, 31, 21, 55, 11, 294264),
 'token': None}
project:{プロジェクトID}
Bucket情報:
Traceback (most recent call last):
  File "/xxxxxxxxx/gcs_list_bucket.py", line 25, in <module>
    print_buckets()
  File "/xxxxxxxxx/gcs_list_bucket.py", line 17, in print_buckets
    for bucket in client.list_buckets():
...
  File "/xxxxxxxxx/venv/lib/python3.11/site-packages/google/cloud/_http/__init__.py", line 494, in api_request
    raise exceptions.from_http_response(response)
google.api_core.exceptions.Forbidden: 403 GET https://storage.googleapis.com/storage/v1/b?project={プロジェクトID}&projection=noAcl&prettyPrint=false: test-bq-admin@{プロジェクトID}.iam.gserviceaccount.com does not have storage.buckets.list access to the Google Cloud project. Permission 'storage.buckets.list' denied on resource (or it may not exist).

$  cat ~/.config/gcloud/application_default_credentials.json
{
  "account": "",
    "client_id": "xxxxxx-yyyyyyyyyyyy.apps.googleusercontent.com",
    "client_secret": "d-xxxxxxxxxxxxxxxxxxxxx",
  "quota_project_id": "{プロジェクトID}",
    "refresh_token": "1//xxxxxxxxxxxxxxxxxxxxx-yyyyyyyyyyyyyyyyy",
  "type": "authorized_user",
  "universe_domain": "googleapis.com"
}