title: Google Cloud credentials with Terraform
body: <p>This is a bit of a newbie question, but I've just gotten started with GCP provisioning using Terraform / Terragrunt, and I find the workflow with obtaining GCP credentials quite confusing. I've come from using AWS exclusively, where obtaining credentials, and configuring them in the AWS CLI was quite straightforward.</p>
  
  <p>Basically, the <a href="https://www.terraform.io/docs/providers/google/provider_reference.html" rel="noreferrer">Google Cloud Provider documentation</a> states that you should define a <code>provider</code> block like so:</p>
  
  <pre><code>provider "google" {
    credentials = "${file("account.json")}"
    project     = "my-project-id"
    region      = "us-central1"
    zone        = "us-central1-c"
  }
  </code></pre>
  
  <p>This <code>credentials</code> field shows I (apparently) must generate a service account, and keep a JSON somewhere on my filesystem.</p>
  
  <p>However, if I run the command <code>gcloud auth application-default login</code>, this generates a token located at <code>~/.config/gcloud/application_default_credentials.json</code>; alternatively I can also use <code>gcloud auth login &lt;my-username&gt;</code>. From there I can access the Google API (which is what Terraform is doing under the hood as well) from the command line using a <code>gcloud</code> command.</p>
  
  <p>So why does the Terraform provider require a JSON file of a service account? Why can't it just use the credentials that the <code>gcloud</code> CLI tool is already using?</p>
  
  <p>By the way, if I configure Terraform to point to the <code>application_default_credentials.json</code> file, I get the following errors:</p>
  
  <blockquote>
    <p>Initializing modules...</p>
    
    <p>Initializing the backend...</p>
    
    <p>Error: Failed to get existing workspaces: querying Cloud Storage
    failed: Get
    <a href="https://www.googleapis.com/storage/v1/b/terraform-state-bucket/o?alt=json&amp;delimiter=%2F&amp;pageToken=&amp;prefix=projects%2Fsomeproject%2F&amp;prettyPrint=false&amp;projection=full&amp;versions=false" rel="noreferrer">https://www.googleapis.com/storage/v1/b/terraform-state-bucket/o?alt=json&amp;delimiter=%2F&amp;pageToken=&amp;prefix=projects%2Fsomeproject%2F&amp;prettyPrint=false&amp;projection=full&amp;versions=false</a>:
    private key should be a PEM or plain PKCS1 or PKCS8; parse error:
    asn1: syntax error: sequence truncated</p>
  </blockquote>