7

This GCP article suggests using two separate projects: one for key management, another for encryption/decryption.

This seems like a setup that works with User roles, but not with Service roles as a Service role is bound to the project it belongs to. Am I missing something?

Is there actually a way to have one role (in, let's say, Project 1), that creates KMS keys, and then have a service role (in, let's say, Project 2) that can access said keys at runtime for decryption?

1 Answer 1

14

It's possible! You can add an IAM policy with the principal(member) & resource in different projects.

To grant [email protected] decryption access to a particular key in project1, you can e.g.:

$ KMS_KEY_RESOURCE_NAME=projects/project1/locations/${location}/keyRings/${keyring_name}/cryptoKeys/${crypto_key_name}
$ gcloud kms keys add-iam-policy-binding \
  --location ${location} ${KMS_KEY_RESOURCE_NAME} \
  --member serviceAccount:[email protected] \
  --role roles/cloudkms.cryptoKeyDecrypter

You can also do this by pasting [email protected] directly into the "Add members" textbox under "Permissions" for a KeyRing or Key selected under http://console.cloud.google.com/iam-admin/kms?project=project1

3
  • Ah, this is absolutely great. Thank you!
    – Venantius
    Commented Mar 11, 2018 at 10:23
  • When I try to paste my service account into the add members textbox, I get the following error: "Email addresses and domains must be associated with an active Google Account or Google Apps account.". This is for an automatically generated App Engine service account - does that make a difference?
    – Venantius
    Commented Mar 11, 2018 at 11:51
  • It looks like my issue here was because the service account came from a standalone App Engine project that was later migrated into an organization - your instructions worked fine when I set up a new App Engine project under the organization and tried with that project's service account.
    – Venantius
    Commented Mar 11, 2018 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.