Can we have an attribute or resource to add ssh key of service-account on os-login

[sebglon]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

When we generate a google service-account key, we need to add there public ssh key on os-login.

The goal is to active os-login access for the service-account key.

A workaroud we have is to add this provisioner on google_service_account_key

  provisioner "local-exec" {
    command = <<EOF
export TMP_FILE=../../ansible/keys/external/${var.papo_project_code}-perrybot.json
echo "${local.perrybot_key_json_content}" > $${TMP_FILE} && \
gcloud auth activate-service-account --key-file=$${TMP_FILE} && \
gcloud compute os-login ssh-keys add --key-file=${self.filename} --ttl 0  &&\
gcloud auth revoke ${google_service_account.provisioner.email} && \
rm $${TMP_FILE}
EOF
  }

New or Affected Resource(s)

• google_service_account_key
• or new resource ?

Potential Terraform Configuration

# Propose what you think the configuration to take advantage of this feature should look like.
# We may not use it verbatim, but it's helpful in understanding your intent.

References

https://cloud.google.com/compute/docs/oslogin/rest/v1/users/importSshPublicKey

• #0000

[sebglon]

Hi today i have an issue.
We can upload a public key for an another service account.
I am the owner of the project but i can't add an SSH Key for a service account on this project.
i have this message: "End user credentials must match the user specified in the request.

[sebglon]

That is the security implementation but we can use the impersonate feature to do that.

[sebglon]

Can i have some help on the API usage?
I have a stange error on the implementation: GoogleCloudPlatform/magic-modules#3221

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!