I'm aware this tool is now partially integrated into gcloud run services proxy, but I find it useful for accessing IAP-protected services without modifying the application.
Proposal
Add a new -impersonate-service-account flag that uses google.golang.org/api/impersonate to generate ID tokens with the correct audience.
This enables access to IAP-protected services with gcloud auth application-default login, without needing service account key files.
Usage
cloud-run-proxy \
-host "https://iap-protected-app.example.com" \
-audience "SA_UNIQUE_ID" \
-authorization-header "Authorization" \
-impersonate-service-account "my-sa@my-project.iam.gserviceaccount.com"
The user needs roles/iam.serviceAccountTokenCreator on the target service account.
I'm aware this tool is now partially integrated into
gcloud run services proxy, but I find it useful for accessing IAP-protected services without modifying the application.Proposal
Add a new
-impersonate-service-accountflag that uses google.golang.org/api/impersonate to generate ID tokens with the correct audience.This enables access to IAP-protected services with
gcloud auth application-default login, without needing service account key files.Usage
The user needs
roles/iam.serviceAccountTokenCreatoron the target service account.