使用服务帐户从 python 调用 Google Cloud Function 进行身份验证

Question

我有一个触发器类型设置为 HTTP 的云函数，还有一个有权调用云函数的服务帐户。我想从 python 脚本调用云函数。我正在使用以下脚本来调用该函数：

from google.oauth2 import service_account
from google.auth.transport.urllib3 import AuthorizedHttp

credentials = service_account.Credentials.from_service_account_file('/path/to/service-account-credentials.json')

scoped_credentials = credentials.with_scopes(['https://www.googleapis.com/auth/cloud-platform'])

authed_http = AuthorizedHttp(scoped_credentials)

response = authed_http.request('GET', 'https://test-123456.cloudfunctions.net/my-cloud-function')

print(response.status)

我收到 Unauthorized (401) 错误作为响应。这是正确的调用方式吗？

Answer 1

为了能够调用您的云函数，您需要一个针对云函数端点的 ID 令牌

from google.oauth2 import service_account
from google.auth.transport.requests import AuthorizedSession


url = 'https://test-123456.cloudfunctions.net/my-cloud-function'

creds = service_account.IDTokenCredentials.from_service_account_file(
       '/path/to/service-account-credentials.json', target_audience=url)

authed_session = AuthorizedSession(creds)

# make authenticated request and print the response, status_code
resp = authed_session.get(url)
print(resp.status_code)
print(resp.text)