Skip to content

CLN: avoid use of service account keys in to_gbq and read_gbq tests #43214

Closed
@tswast

Description

@tswast

The GCP project we (are? were?) using to test the to_gbq and read_gbq is scheduled to get a policy applied to it that prevents the use of service account key files. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_key_creation

In anticipation of this change:

  1. Are the to_gbq and read_gbq tests still running in the CI for this project? It's been a while since I've last looked and I've forgotten where they would be running.

  2. If they are running somewhere and we want to continue running them, we need to do something about this upcoming restriction.
    a. Ideally we'd migrate these tests to a service that doesn't require a GCP service account key file to connect to BigQuery. Cloud Build could be a good candidate, as it has a service account associated with it that doesn't require a key file. I could help migrate these tests if that's what we choose to do.
    b. We continue to use a key file, but it'd have to be a project not associated with Google. This may be more difficult to get billing figured out (not that the tests actually cost that much to run, but there's overhead in getting the billing accounts setup plus whomever sets them up is a bit at risk if someone abuses the credentials)

I'd appreciate your thoughts so that we can continue to ensure these methods work well.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions