CyberCoveLLC/threshold-plugin-gcp
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Review comments - Add info in error messages

Browse Source
This commit is contained in:
adityawalvekar committed 2026-04-09 16:34:50 +05:30
1 parent 437fc99875
commit 89ac628428
1 file changed
+8 -8
Download Patch File Download Diff File Expand all files Collapse all files
internal/credential/rotate.go
+8 -8
View File
@@ -90,12 +90,12 @@ func (c *Config) RotateServiceAccountKey(
clientOptions := []option.ClientOption{option.WithTokenSource(creds.TokenSource)}
clientOptions = append(clientOptions, opts...)
iamClient, err := admin.NewIamClient(ctx, clientOptions...)
currentIAMClient, err := admin.NewIamClient(ctx, clientOptions...)
if err != nil {
return status.Errorf(codes.Internal, "error creating IAM client: %v", err)
}
createServiceAccountKeyRes, err := iamClient.CreateServiceAccountKey(ctx, &adminpb.CreateServiceAccountKeyRequest{
createServiceAccountKeyRes, err := currentIAMClient.CreateServiceAccountKey(ctx, &adminpb.CreateServiceAccountKeyRequest{
Name: fmt.Sprintf("projects/%s/serviceAccounts/%s", c.ProjectId, c.ClientEmail),
PrivateKeyType: adminpb.ServiceAccountPrivateKeyType_TYPE_GOOGLE_CREDENTIALS_FILE,
KeyAlgorithm: adminpb.ServiceAccountKeyAlgorithm_KEY_ALG_RSA_2048,
@@ -129,33 +129,33 @@ func (c *Config) RotateServiceAccountKey(
err = newConfig.ValidateServiceAccountKey(ctx, permissions, validateCredsCallback, clientOptions...)
if err != nil {
// Roll back the new key if validation fails.
rollbackErr := iamClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{
rollbackErr := currentIAMClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{
Name: fmt.Sprintf("projects/%s/serviceAccounts/%s/keys/%s", newConfig.ProjectId, newConfig.ClientEmail, newConfig.PrivateKeyId),
})
if rollbackErr != nil {
return status.Errorf(codes.PermissionDenied, "error validating rotated service account key: %v; error rolling back newly created service account key: %v", err, rollbackErr)
return status.Errorf(codes.PermissionDenied, "error validating rotated service account key: %v; error rolling back newly created service account key: %v; service account may have multiple active keys", err, rollbackErr)
}
return status.Errorf(codes.PermissionDenied, "error validating rotated service account key: %v; successfully rolled back newly created service account key", err)
}
newClient, err := admin.NewIamClient(ctx, clientOptions...)
newIAMClient, err := admin.NewIamClient(ctx, clientOptions...)
if err != nil {
return status.Errorf(codes.Internal, "error creating IAM client with rotated service account key: %v", err)
}
err = newClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{
err = newIAMClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{
Name: fmt.Sprintf("projects/%s/serviceAccounts/%s/keys/%s", c.ProjectId, c.ClientEmail, c.PrivateKeyId),
})
// If deletion of the old key fails, attempt to delete the new key to avoid leaving a dangling key, then return an error.
if err != nil {
// delete the new key using old client since the new client may not have permissions that the old client has.
rollbackErr := iamClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{
rollbackErr := currentIAMClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{
Name: fmt.Sprintf("projects/%s/serviceAccounts/%s/keys/%s", newConfig.ProjectId, newConfig.ClientEmail, newConfig.PrivateKeyId),
})
// If rollback also fails, return an error indicating both the failure to delete the old key and the failure to roll back the new key.
if rollbackErr != nil {
return status.Errorf(codes.Internal, "error deleting service account key: %v; error rolling back newly created service account key: %v", err, rollbackErr)
return status.Errorf(codes.Internal, "error deleting service account key: %v; error rolling back newly created service account key: %v; service account may have multiple active keys", err, rollbackErr)
}
return status.Errorf(codes.Internal, "error deleting service account key: %v; successfully rolled back newly created service account key", err)