验证 bigQuery 客户端的"默认凭据"背后的逻辑是什么

Question

我看到了验证bigQuery java客户端的两种方法

/**
 * Creates an authorized Bigquery client service using Application Default Credentials.
 *
 * @return an authorized Bigquery client
 * @throws IOException if there's an error getting the default credentials.
 */
public static Bigquery createAuthorizedClient() throws IOException {
    // Create the credential
    HttpTransport transport = new NetHttpTransport();
    JsonFactory jsonFactory = new JacksonFactory();
    GoogleCredential credential = GoogleCredential.getApplicationDefault(transport, jsonFactory);
    // Depending on the environment that provides the default credentials (e.g. Compute Engine, App
    // Engine), the credentials may require us to specify the scopes we need explicitly.
    // Check for this case, and inject the Bigquery scope if required.
    if (credential.createScopedRequired()) {
        credential = credential.createScoped(BigqueryScopes.all());
    }
    return new Bigquery.Builder(transport, jsonFactory, credential)
            .setApplicationName("Bigquery Samples")
            .build();
}

和

public class QuickstartSample {
    public static void Main() {
       // Your Google Cloud Platform project ID
       string projectId = "YOUR_PROJECT_ID";
       // Instantiates a client
       BigqueryClient client = BigqueryClient.Create(projectId);
       // The id for the new dataset
       string datasetId = "my_new_dataset";
       // Creates the dataset
       BigqueryDataset dataset = client.CreateDataset(datasetId);
       Console.WriteLine($"Dataset {dataset.FullyQualifiedId} created.");
    }
}

这是什么意思?

default credentials (e.g. Compute Engine, App Engine)

它将无法访问我的特定GCP项目，对吗?

那么这些default credentials的意义是什么呢?

Answer 1

使用"应用程序默认凭据"，应用程序使用自己的服务帐户，而不是最终用户的服务帐户。详见https://cloud.google.com/bigquery/authentication#app-default-cred