title: Simulate behavior analogous to "sts assume role" for GCP for setting up a global authentication in local environment
body: <p>I believe I have hit a dead end but i would like some validation from an expert.</p>
  <p>I started to learn GCP this week and I am trying to achieve something that I was previously able to achieve with the AWS cloud platform. Please bare with me as I know nothing about the GCP.</p>
  <p><strong>Problem:</strong></p>
  <p>On a local machine, configure <strong>dynamically fetched, short-lived credentials for authenticating with public cloud apis (static keys are out of question)</strong>,</p>
  <p>for when an authenticated human user (GCP: IAM User, AWS: IAM User) is impersonating a non-human identity (GCP: IAM Service Accout, AWS: IAM Role),</p>
  <p>in a way that the client SDK's offered by the public cloud platform use those credentials as default (impersonated non-human) identity when they make calls to the public cloud platform APIs.</p>
  <p>Let us say, on my local machine:
  I have an authenticated <strong>User A</strong>, who needs to make calls to the public cloud apis on behalf of <strong>ServiceAccount/Role B</strong>.</p>
  <p><strong>Platform:</strong></p>
  <p>AWS - Solved</p>
  <p>GCP - Unsolved</p>
  <p><strong>AWS Solution</strong></p>
  <p>In AWS, the problem statement will be:
  From my local machine, where I am authenticated as User-A, I want my local AWS client SDK to make calls to AWS APIs as IAM-ROLE-B</p>
  <p>The solution is the following:</p>
  <p>1 - Authorize User-A to perform sts:AssumeRole on IAM-ROLE-B via an IAM Role Policy on User-A</p>
  <p>2 - Authorize User-A to perform sts:AssumeRole on IAM-ROLE-B via an IAM Assume Role Policy on User-B</p>
  <p>3 - Use, for example, the aws cli to make an AssumeRole operation call to AWS <strong>STS</strong> API. This will return me: a. Access Key ID and b. Secret Access Key</p>
  <p>4 - Set these in the ~/.aws/.creds file and all the SDKs default to these creds</p>
  <p><strong>Barrier in GCP</strong></p>
  <p><strong>The problem occurs when I try to simulate the same behavior for GCP.</strong></p>
  <p><strong>From my local machine, where I am authenticated as User-A, I want my local GCP client SDK to make calls to GCP APIs as SERVICE-ACCOUNT-B</strong></p>
  <p>Since i need dynamic short-lived creds, I can not use a service account key file which is static, and too insecure, and we know good reasons to not use it.</p>
  <p>The only other option that I am aware of is to &quot;impersonate&quot; a service account (make calls on behalf of SERVICE-ACCOUNT-B) via the <a href="https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken" rel="nofollow noreferrer">projects.serviceAccounts.generateAccessToken</a>. From my AWS analogy, I receive the access Key ID and access key secret in Step 3,
  <strong>that I can set globally (to be used by the client SDKs).</strong></p>
  <p><strong>In the case of GCP, the projects.serviceAccounts.generateAccessToken call gives me an AccessToken, which is basically the short lived authentication to make calls on behalf of SERVICE-ACCOUNT-B.</strong></p>
  <p><strong>Although I can inject this access token into requests I intend to make to future calls to GCP, is there any way to set this globally to be picked up automatically by GCP client SDKs, where I do not have to modify my code base and inject this token somehow in my code?</strong></p>
  <p>Recalling the fact that I am a total GCP newbie, am I even thinking in the right direction? Or did I completely mess up GCP auth concepts and go the wrong way in my approach to solve the problem?</p>
  <p>Any input and ideas to solve the problem (without static keys) are highly appreciated.</p>