如何将带有秘密管理器的谷歌应用程序引擎连接到Postgres

Question

我正试图通过秘密管理器从GAE中运行的nodejs/typescript代码库连接到GCP管理的Postgres数据库。

我得到：

Error: 7 PERMISSION_DENIED: Permission denied on resource project DATABASE_USER.   

当我在GAE中运行它时。

Answer 1

首先，确保您已授予IAM中GAE服务帐户的机密访问权限。

然后使用以下代码示例从secret manager获取ENV vars。

import * as path from 'path';
import {SecretManagerServiceClient} from '@google-cloud/secret-manager';
import deasync from 'deasync';

require('dotenv').config();
const SnakeNamingStrategy =
require('typeorm-naming-strategies').SnakeNamingStrategy;
const googleProjectId = process.env.GOOGLE_CLOUD_PROJECT;
const isInGAE = googleProjectId !== undefined;
const isLocalUsingCloudProxy = process.env.USE_CLOUD_SQL_AUTH_PROXY !== undefined;

const getSecretSync = deasync((name: string, cb:any) => {
const c = new SecretManagerServiceClient();

c.accessSecretVersion({name: c.secretVersionPath(googleProjectId, name, "latest")}).then(([secret]) => {
cb(null, secret.payload.data.toString());
}).catch((err) => {
cb(err);
});
});

let config = {
type: 'postgres',
host: process.env.DATABASE_HOST || 'localhost',
port: parseInt(process.env.DATABASE_PORT, 10) || 5432,
username: process.env.DATABASE_USER,
password: process.env.DATABASE_PASSWORD,
database: process.env.DATABASE_NAME,
synchronize: false,
logging: false,
subscribers: [path.join(__dirname, '..', 'subscribers', '*.{ts,js}')],
entities: [path.join(__dirname, '..', 'models', '*.{ts,js}')],
migrations: [path.join(__dirname, '..', 'migrations', '*.{ts,js}')],
cli: {
entitiesDir: [path.join(__dirname, '..', 'models', '*.{ts,js}')],
migrationsDir: [path.join(__dirname, '..', 'migrations', '*.{ts,js}')],
},
namingStrategy: new SnakeNamingStrategy(),
};

if (isInGAE || isLocalUsingCloudProxy) {
config.username = getSecretSync("DATABASE_USER");
config.password = getSecretSync("DATABASE_PASSWORD");
config.database = getSecretSync("DATABASE_NAME");
config.host = isInGAE ? "/cloudsql/" + getSecretSync("DATABASE_HOST") : 'localhost';
config.port = isInGAE ? parseInt(getSecretSync("DATABASE_PORT"), 10) : 5432;
console.log("dbuser", config.username);
}

需要注意的是DATABASE_ HOST应该是"；连接名称"；在"SQL"选项卡上，如project-id:us-central1:db-name