1

We're making some machines in which there's a part which uploads the images captured by the camera to Google Cloud Storage. For this purpose what I've done is

  1. Create a service account for each machine.
  2. Create a custom role with permissions:
storage.objects.create
storage.buckets.get
storage.objects.get
  1. Apply this role to that service account.
  2. Download the JSON credentials key file and use this file with python script (in which I specify bucket name) to upload image to GCP Storage.

Is this way of doing things efficient and secure given that we only ship 2-3 machines each month?

Also I will have to ship JSON file with each machine, if the above method is valid, is this fine or there's any method to hide this key file?

1

Yes, your approach sounds okay to me. I am not sure how you "ship" machines but it is a good idea to use a service account per machine as you can delete the service account key if the machine ever becomes compromised.

You can, and should, fully automate the process of generating the credentials key files using the Google APIs or gcloud cli.

It is best practice to periodically rotate (re-issue) credentials key files. This is in case they are accidentally leaked in a way that you do not notice. If you always revoke the key and issue a new one every month then it limits the total damage somewhat.

If you do rotate keys then you have a key distribution problem. How do you securely distribute the new credentials key files onto machines you shipped in the past? You can use GnuPG to create a public-private key pair on every host. Each month you can run a script that generates a new credentials key file per machine, encrypt it with the machine's public GPG key, then delete the old service account keys.

The script that pushes images to a bucket must then periodically "phone home" to collect a fresh GPG encrypted credentials key file. It can then decrypt it with its own private key. One way to do this is to put the encrypted keys into a different bucket. Create a single service account that can only read that bucket. Create a single credentials key file for that service account that you install onto every machine. That key can then only be used to only collect encrypted keys that can only be decrypted on the correct host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.