Revoke access with cloud computing about berglas HOT 4 CLOSED

Hi @sshashwat66

Thank you for opening an issue. Can you share the steps and commands you are running to grant and revoke access to the secret?

Also, if there is no access defined, meaning when I put the secret and try to access it I get the unencrypted access. Shouldn't the secret be always protected and only accessible by the SA or member whom we add using the berglas grant ${BUCKET_ID}/foo --member * command ?

You are most likely an owner of the project and the bucket, meaning you inherit those permissions by being a project.owner. In general, the user who creates the secret will have access to read it.

from berglas.

Thanks for the reply @sethvargo
Commands to revoke the secret:

berglas revoke ${BUCKET_ID}/abcd/xyz \
  --member serviceAccount:[email protected]

Command to read the secret:

berglas access ${BUCKET_ID}/abcd/xyz

Also yes, I am owner of the project but I am using the SA to access the creds using this command I am switching as a SA

gcloud auth activate-service-account [email protected] \
  --key-file=key.json

Which I verify by gcloud config list

from berglas.

What is the output of:

gcloud auth list

Berglas uses the Default Application Credentials (glcoud auth application-default). Can you try setting the environment variable GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/key.json?

You can also see what has permissions on the Cloud Storage bucket in the Web UI. Double check for typos, etc. (berglas revoke will succeed if given a non-existent member).

from berglas.

Got it.
It was because of GOOGLE_APPLICATION_CREDENTIALS.
Thanks.

from berglas.