GAE Flex permission denied on decrypt about berglas

[jasonjho]

Turns out I had to apply the bindings to the AppEngine default service account (there are 2 for Flex) in addition to [e-mail].

Not sure if this is unique to my instance or if the docs should be updated to reflect this.

[sethvargo]

I see a few things here:

• my_key_ring vs my-key-ring. Not sure if that's a typo or intended. Please ensure you're using the correct keyring ID

• The AppEngine service account should be [email protected]

[jasonjho]

Hi @sethvargo, thanks for clarifying. Yep, those typos were from just filling out the comment.

Follow up q: is it then, necessary (as per the examples) to apply policy bindings to the other Flex serviceaccount?

[sethvargo]

Hi @jasonjho

On all GAEs (Standard and Flex), the following SA exists:

[email protected]

In addition to the standard SA, Flex includes an additional SA:

[e-mail]

[jasonjho]

@sethvargo Yep, understood. From the Flex examples setup/readme, it says to grant the secret to:

SA_EMAIL=${PROJECT_NUMBER}[email protected]
berglas grant ${BUCKET_ID}/my-secret-config --member serviceAccount:${SA_EMAIL}

Given that there are 2 service accounts, which is the right service account to grant access to the berglas secret? Is it both? Just one? It would be helpful to understand why, in either case.

It's not clear.

[sethvargo]

I think it's actually just [email protected] for Berglas, but I don't/won't have time to test and verify that for a few weeks :frown:

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.