Can I authenticate users from multiple Google cloud projects Vault's auth/gcp

Question

I'd like to use Vault to store/retrieve secrets for different projects on Google Cloud. Vault itself is in its own gcp project. Can I use Vault to authenticate the service accounts of multiple different projects?

My attempt to do so is yielding an error on missing permission.

I've checked that the service account that Vault is using has the iam.serviceAccountKeys.get permission. The service account trying to be authenticated doesn't.

I'm guessing that the permission error is about trying to find check the service account key of a foreign project.

* could not find service account key 'projects/-/serviceAccounts/[email protected]/keys/xxxxxxxxxxxx': googleapi: 

Error 403: Permission iam.serviceAccountKeys.get is required to perform this operation on service account key projects/-/serviceAccounts/[email protected]/keys/xxxxxxxxxxxxxxx., forbidden or could not find Google Oauth cert with given 'kid' id xxxxxxxxxxxxxxxxxxx: could not find public key with kid 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'

Does iam.serviceAccountKeys.get only allow authentication of ids within the project?

Answer 1

Yes, you need to make sure that bound_projects is either empty or includes the list of all projects for which you want to bind:

$ vault write auth/gcp/config /
    bound_projects=p1,p2,p3...

You also need to make sure that the service account which is running Vault has the following roles:

roles/iam.serviceAccountKeyAdmin
roles/browser

You need to give the following roles to the service account which is authenticating to Vault:

roles/iam.serviceAccountTokenCreator