Google Cloud SDK with Service Account on Raspberry Pi
Using a Raspberry Pi to interact with your Google Cloud Platform projects without having to expose your user credentials.
Install the Google Cloud SDK on a Raspberry Pi to access and interact with your Google Cloud Platform projects via a Service Account. In this example, we’ll create a Service Account with access to load speedtest result data into Google BigQuery.
Create the Service Account
Google Cloud official documentation for creating service accounts.
Using the Cloud Console, we’ll create a service account with access to load data into BigQuery for our particular project.
First — Navigate to the Cloud Console Service Account menu using the link below or by selecting IAM & Admin →Service Accounts.
From the blue bar at the top of the screen, ensure that the proper project is displayed, otherwise click the project name to select another project.
In the Service account dropdown, select “New service account”
Specify a descriptive name for the service account and select the appropriate role. Since we are creating an account for loading data into BigQuery, we’ll specify the following:
- Service account name: Bigquery Speedtest Loader
- Role: BigQuery User & BigQuery Data Owner
Modify or accept the generated account for Service account ID.
Click the blue Create button to create the account and generate the JSON file which will be downloaded to your computer.
**Be sure to keep this file PRIVATE as it will provide access to your project and resources that you specified for the service account. **
We’ll need this JSON file later after we install the Google Cloud SDK on our Raspberry Pi. Also take note of the full Service Account ID (we’ll need it later). In my case, the following full Service Account ID was created:
Install the Google Cloud SDK
Full instructions for installing the Google Cloud SDK
We’ll use a Raspberry Pi device with a Debian-based distribution already installed.
Create a user account on the operating system to link to our service account
sudo useradd -m bigquery-speedtest-loader
Add the Cloud SDK distribution URI as a package source:
echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
Make sure you have apt-transport-https installed:
sudo apt-get install apt-transport-https ca-certificates gnupg
Import the Google Cloud public key:
curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key --keyring /usr/share/keyrings/cloud.google.gpg add -
Update and install the Cloud SDK:
sudo apt-get update && sudo apt-get install google-cloud-sdk
Activate the Service Account
Start by getting into the new OS account that we just created
sudo su - bigquery-speedtest-loader
Activate the Service Account using the JSON file that we generated earlier. You will need to copy the contents of the JSON file to a secure location.
mkdir .private/vi .private/name-of-JSON-file.json
Since the JSON file is just a simple text file, it’s easiest to just copy/paste the contents from where you downloaded the file to the path identified above. Feel free to us ‘vi’ or your favorite text editor. Once you’ve successfully created the file, we’ll activate the Service Account.
gcloud auth activate-service-account email@example.com --key-file=/home/bigquery-speedtest-loader/.private/name-of-JSON-file.json
Confirm that everything is working by issuing the command gcloud auth list
bigquery-speedtest-loader@vpn-edge:~/.private $ gcloud auth list Credentialed Accounts
* firstname.lastname@example.orgTo set the active account, run:
$ gcloud config set account `ACCOUNT`
You now have a user account on your Raspberry Pi that can interact with your Google Cloud Platform Project for the specified OS user.
To add or remove permissions from the service account, navigate to the Service Accounts section of the IAM & Admin menu. Be sure to follow the Principle of Least Privilege when adding permissions to your service accounts.
Pro Tip: Be sure to specify the OS user that we created above when scripting jobs that interact with your Google Cloud projects from CRON.