ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ ์‚ฌ์šฉ์„ ์œ„ํ•œ ์ธ์ฆ

์ด ํŽ˜์ด์ง€์—์„œ๋Š” ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ Google API์— ์•ก์„ธ์Šคํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์„ค๋ช…ํ•ฉ๋‹ˆ๋‹ค.

ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ์ง€์›๋˜๋Š” ์–ธ์–ด๋กœ Google Cloud API์— ์‰ฝ๊ฒŒ ์•ก์„ธ์Šคํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์›์‹œ ์š”์ฒญ์„ ์„œ๋ฒ„์— ๋ณด๋‚ด Google Cloud API๋ฅผ ์ง์ ‘ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์ง€๋งŒ ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ž‘์„ฑํ•ด์•ผ ํ•˜๋Š” ์ฝ”๋“œ ์–‘์„ ํฌ๊ฒŒ ์ค„์—ฌ ์ฃผ๋Š” ๊ฐ„์†Œํ™” ๊ธฐ๋Šฅ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์ด๋Š” ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๊ฐ€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ๊ธฐ๋ณธ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด(ADC)๋ฅผ ์ง€์›ํ•˜๊ธฐ ๋•Œ๋ฌธ์— ํŠนํžˆ ๋” ๊ทธ๋ ‡์Šต๋‹ˆ๋‹ค.

์™ธ๋ถ€ ์†Œ์Šค(์˜ˆ: ๊ณ ๊ฐ)์˜ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ(JSON, ํŒŒ์ผ ๋˜๋Š” ์ŠคํŠธ๋ฆผ)์„ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์™ธ๋ถ€ ์†Œ์Šค ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์„ ์‚ฌ์šฉํ•  ๋•Œ์˜ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์„ ๊ฒ€ํ† ํ•˜์„ธ์š”.

ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์— ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ๊ธฐ๋ณธ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ์‚ฌ์šฉ

์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ๊ธฐ๋ณธ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ์ธ์ฆํ•˜๋ ค๋ฉด ๋จผ์ € ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์‹คํ–‰๋˜๋Š” ํ™˜๊ฒฝ์— ๋Œ€ํ•œ ADC๋ฅผ ์„ค์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ํด๋ผ์ด์–ธํŠธ๋ฅผ ๋งŒ๋“œ๋Š” ๊ฒฝ์šฐ ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ฝ”๋“œ๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” API์— ์ธ์ฆํ•˜๊ธฐ ์œ„ํ•ด ADC์— ์ œ๊ณต๋œ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด๋ฅผ ์ž๋™์œผ๋กœ ํ™•์ธํ•˜๊ณ  ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค. ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ํ† ํฐ์„ ๋ช…์‹œ์ ์œผ๋กœ ์ธ์ฆํ•˜๊ฑฐ๋‚˜ ๊ด€๋ฆฌํ•  ํ•„์š”๊ฐ€ ์—†์Šต๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ์š”๊ตฌ์‚ฌํ•ญ์€ ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์— ์˜ํ•ด ์ž๋™์œผ๋กœ ๊ด€๋ฆฌ๋ฉ๋‹ˆ๋‹ค.

๋กœ์ปฌ ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์˜ ๊ฒฝ์šฐ gcloud CLI๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๋˜๋Š” ์„œ๋น„์Šค ๊ณ„์ • ๊ฐ€์žฅ์œผ๋กœ ADC๋ฅผ ์„ค์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ํ”„๋กœ๋•์…˜ ํ™˜๊ฒฝ์˜ ๊ฒฝ์šฐ ์„œ๋น„์Šค ๊ณ„์ •์„ ์—ฐ๊ฒฐํ•˜์—ฌ ADC๋ฅผ ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค.

ํด๋ผ์ด์–ธํŠธ ๋งŒ๋“ค๊ธฐ ์˜ˆ์‹œ

๋‹ค์Œ ์ฝ”๋“œ ์ƒ˜ํ”Œ์€ Cloud Storage ์„œ๋น„์Šค์˜ ํด๋ผ์ด์–ธํŠธ๋ฅผ ๋งŒ๋“ญ๋‹ˆ๋‹ค. ์ฝ”๋“œ์—๋Š” ์—ฌ๋Ÿฌ ํด๋ผ์ด์–ธํŠธ๊ฐ€ ํ•„์š”ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ด ์ƒ˜ํ”Œ์—์„œ๋Š” ํด๋ผ์ด์–ธํŠธ๋ฅผ ๋งŒ๋“ค๊ณ  ๋ช…์‹œ์ ์œผ๋กœ ์ธ์ฆํ•˜๊ธฐ ์œ„ํ•œ ์ฝ”๋“œ ์—†์ด ์‚ฌ์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ๋ณด์—ฌ์ฃผ๊ธฐ ์œ„ํ•œ ๊ฒƒ์ž…๋‹ˆ๋‹ค.

๋‹ค์Œ ์ƒ˜ํ”Œ์„ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € ๋‹ค์Œ ๋‹จ๊ณ„๋ฅผ ์™„๋ฃŒํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

Go

import (
	"context"
	"fmt"
	"io"

	"cloud.google.com/go/storage"
	"google.golang.org/api/iterator"
)

// authenticateImplicitWithAdc uses Application Default Credentials
// to automatically find credentials and authenticate.
func authenticateImplicitWithAdc(w io.Writer, projectId string) error {
	// projectId := "your_project_id"

	ctx := context.Background()

	// NOTE: Replace the client created below with the client required for your application.
	// Note that the credentials are not specified when constructing the client.
	// The client library finds your credentials using ADC.
	client, err := storage.NewClient(ctx)
	if err != nil {
		return fmt.Errorf("NewClient: %w", err)
	}
	defer client.Close()

	it := client.Buckets(ctx, projectId)
	for {
		bucketAttrs, err := it.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return err
		}
		fmt.Fprintf(w, "Bucket: %v\n", bucketAttrs.Name)
	}

	fmt.Fprintf(w, "Listed all storage buckets.\n")

	return nil
}

์ž๋ฐ”


import com.google.api.gax.paging.Page;
import com.google.cloud.storage.Bucket;
import com.google.cloud.storage.Storage;
import com.google.cloud.storage.StorageOptions;
import java.io.IOException;

public class AuthenticateImplicitWithAdc {

  public static void main(String[] args) throws IOException {
    // TODO(Developer):
    //  1. Before running this sample,
    //  set up Application Default Credentials as described in
    //  https://cloud.google.com/docs/authentication/external/set-up-adc
    //  2. Replace the project variable below.
    //  3. Make sure you have the necessary permission to list storage buckets
    //  "storage.buckets.list"
    String projectId = "your-google-cloud-project-id";
    authenticateImplicitWithAdc(projectId);
  }

  // When interacting with Google Cloud Client libraries, the library can auto-detect the
  // credentials to use.
  public static void authenticateImplicitWithAdc(String project) throws IOException {

    // *NOTE*: Replace the client created below with the client required for your application.
    // Note that the credentials are not specified when constructing the client.
    // Hence, the client library will look for credentials using ADC.
    //
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests.
    Storage storage = StorageOptions.newBuilder().setProjectId(project).build().getService();

    System.out.println("Buckets:");
    Page<Bucket> buckets = storage.list();
    for (Bucket bucket : buckets.iterateAll()) {
      System.out.println(bucket.toString());
    }
    System.out.println("Listed all storage buckets.");
  }
}

Node.js

/**
 * TODO(developer):
 *  1. Uncomment and replace these variables before running the sample.
 *  2. Set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc
 *  3. Make sure you have the necessary permission to list storage buckets "storage.buckets.list"
 *    (https://cloud.google.com/storage/docs/access-control/iam-permissions#bucket_permissions)
 */
// const projectId = 'YOUR_PROJECT_ID';

const {Storage} = require('@google-cloud/storage');

async function authenticateImplicitWithAdc() {
  // This snippet demonstrates how to list buckets.
  // NOTE: Replace the client created below with the client required for your application.
  // Note that the credentials are not specified when constructing the client.
  // The client library finds your credentials using ADC.
  const storage = new Storage({
    projectId,
  });
  const [buckets] = await storage.getBuckets();
  console.log('Buckets:');

  for (const bucket of buckets) {
    console.log(`- ${bucket.name}`);
  }

  console.log('Listed all storage buckets.');
}

authenticateImplicitWithAdc();

PHP

// Imports the Cloud Storage client library.
use Google\Cloud\Storage\StorageClient;

/**
 * Authenticate to a cloud client library using a service account implicitly.
 *
 * @param string $projectId The Google project ID.
 */
function auth_cloud_implicit($projectId)
{
    $config = [
        'projectId' => $projectId,
    ];

    # If you don't specify credentials when constructing the client, the
    # client library will look for credentials in the environment.
    $storage = new StorageClient($config);

    # Make an authenticated API request (listing storage buckets)
    foreach ($storage->buckets() as $bucket) {
        printf('Bucket: %s' . PHP_EOL, $bucket->name());
    }
}

Python


from google.cloud import storage


def authenticate_implicit_with_adc(project_id="your-google-cloud-project-id"):
    """
    When interacting with Google Cloud Client libraries, the library can auto-detect the
    credentials to use.

    // TODO(Developer):
    //  1. Before running this sample,
    //  set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc
    //  2. Replace the project variable.
    //  3. Make sure that the user account or service account that you are using
    //  has the required permissions. For this sample, you must have "storage.buckets.list".
    Args:
        project_id: The project id of your Google Cloud project.
    """

    # This snippet demonstrates how to list buckets.
    # *NOTE*: Replace the client created below with the client required for your application.
    # Note that the credentials are not specified when constructing the client.
    # Hence, the client library will look for credentials using ADC.
    storage_client = storage.Client(project=project_id)
    buckets = storage_client.list_buckets()
    print("Buckets:")
    for bucket in buckets:
        print(bucket.name)
    print("Listed all storage buckets.")

Ruby

def authenticate_implicit_with_adc project_id:
  # The ID of your Google Cloud project
  # project_id = "your-google-cloud-project-id"

  ###
  # When interacting with Google Cloud Client libraries, the library can auto-detect the
  # credentials to use.
  # TODO(Developer):
  #   1. Before running this sample,
  #      set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc
  #   2. Replace the project variable.
  #   3. Make sure that the user account or service account that you are using
  #      has the required permissions. For this sample, you must have "storage.buckets.list".
  ###

  require "google/cloud/storage"

  # This sample demonstrates how to list buckets.
  # *NOTE*: Replace the client created below with the client required for your application.
  # Note that the credentials are not specified when constructing the client.
  # Hence, the client library will look for credentials using ADC.
  storage = Google::Cloud::Storage.new project_id: project_id
  buckets = storage.buckets
  puts "Buckets: "
  buckets.each do |bucket|
    puts bucket.name
  end
  puts "Plaintext: Listed all storage buckets."
end

ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ API ํ‚ค ์‚ฌ์šฉ

API ํ‚ค๋ฅผ ํ—ˆ์šฉํ•˜๋Š” API์˜ ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์—์„œ๋งŒ API ํ‚ค๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋˜ํ•œ API ํ‚ค์— API์— ์‚ฌ์šฉ๋˜์ง€ ๋ชปํ•˜๋„๋ก ํ•˜๋Š” API ์ œํ•œ์‚ฌํ•ญ์ด ์—†์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

์ต์Šคํ”„๋ ˆ์Šค ๋ชจ๋“œ์—์„œ ์ƒ์„ฑ๋œ API ํ‚ค์— ๊ด€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ Google Cloud ์ต์Šคํ”„๋ ˆ์Šค ๋ชจ๋“œ FAQ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

์ด ์˜ˆ์‹œ์—์„œ๋Š” API ํ‚ค๋ฅผ ํ—ˆ์šฉํ•˜๋Š” Cloud Natural Language API๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ API ํ‚ค๋ฅผ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์— ์ œ๊ณตํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ๋ณด์—ฌ์ค๋‹ˆ๋‹ค.

C#

์ด ์ƒ˜ํ”Œ์„ ์‹คํ–‰ํ•˜๋ ค๋ฉด Natural Language ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์„ค์น˜ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.


using Google.Cloud.Language.V1;
using System;

public class UseApiKeySample
{
    public void AnalyzeSentiment(string apiKey)
    {
        LanguageServiceClient client = new LanguageServiceClientBuilder
        {
            ApiKey = apiKey
        }.Build();

        string text = "Hello, world!";

        AnalyzeSentimentResponse response = client.AnalyzeSentiment(Document.FromPlainText(text));
        Console.WriteLine($"Text: {text}");
        Sentiment sentiment = response.DocumentSentiment;
        Console.WriteLine($"Sentiment: {sentiment.Score}, {sentiment.Magnitude}");
        Console.WriteLine("Successfully authenticated using the API key");
    }
}

C++

์ด ์ƒ˜ํ”Œ์„ ์‹คํ–‰ํ•˜๋ ค๋ฉด Natural Language ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์„ค์น˜ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

#include "google/cloud/language/v1/language_client.h"
#include "google/cloud/credentials.h"
#include "google/cloud/options.h"

void AuthenticateWithApiKey(std::vector<std::string> const& argv) {
  if (argv.size() != 2) {
    throw google::cloud::testing_util::Usage{
        "authenticate-with-api-key <project-id> <api-key>"};
  }
  namespace gc = ::google::cloud;
  auto options = gc::Options{}.set<gc::UnifiedCredentialsOption>(
      gc::MakeApiKeyCredentials(argv[1]));
  auto client = gc::language_v1::LanguageServiceClient(
      gc::language_v1::MakeLanguageServiceConnection(options));

  auto constexpr kText = "Hello, world!";

  google::cloud::language::v1::Document d;
  d.set_content(kText);
  d.set_type(google::cloud::language::v1::Document::PLAIN_TEXT);

  auto response = client.AnalyzeSentiment(d, {});
  if (!response) throw std::move(response.status());
  auto const& sentiment = response->document_sentiment();
  std::cout << "Text: " << kText << "\n";
  std::cout << "Sentiment: " << sentiment.score() << ", "
            << sentiment.magnitude() << "\n";
  std::cout << "Successfully authenticated using the API key\n";
}

Go

์ด ์ƒ˜ํ”Œ์„ ์‹คํ–‰ํ•˜๋ ค๋ฉด Natural Language ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์„ค์น˜ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

import (
	"context"
	"fmt"
	"io"

	language "cloud.google.com/go/language/apiv1"
	"cloud.google.com/go/language/apiv1/languagepb"
	"google.golang.org/api/option"
)

// authenticateWithAPIKey authenticates with an API key for Google Language
// service.
func authenticateWithAPIKey(w io.Writer, apiKey string) error {
	// apiKey := "api-key-string"

	ctx := context.Background()

	// Initialize the Language Service client and set the API key.
	client, err := language.NewClient(ctx, option.WithAPIKey(apiKey))
	if err != nil {
		return fmt.Errorf("NewClient: %w", err)
	}
	defer client.Close()

	text := "Hello, world!"
	// Make a request to analyze the sentiment of the text.
	res, err := client.AnalyzeSentiment(ctx, &languagepb.AnalyzeSentimentRequest{
		Document: &languagepb.Document{
			Source: &languagepb.Document_Content{
				Content: text,
			},
			Type: languagepb.Document_PLAIN_TEXT,
		},
	})
	if err != nil {
		return fmt.Errorf("AnalyzeSentiment: %w", err)
	}

	fmt.Fprintf(w, "Text: %s\n", text)
	fmt.Fprintf(w, "Sentiment score: %v\n", res.DocumentSentiment.Score)
	fmt.Fprintln(w, "Successfully authenticated using the API key.")

	return nil
}

Node.js

์ด ์ƒ˜ํ”Œ์„ ์‹คํ–‰ํ•˜๋ ค๋ฉด Natural Language ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์„ค์น˜ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.


const {
  v1: {LanguageServiceClient},
} = require('@google-cloud/language');

/**
 * Authenticates with an API key for Google Language service.
 *
 * @param {string} apiKey An API Key to use
 */
async function authenticateWithAPIKey(apiKey) {
  const language = new LanguageServiceClient({apiKey});

  // Alternatively:
  // const {GoogleAuth} = require('google-auth-library');
  // const auth = new GoogleAuth({apiKey});
  // const language = new LanguageServiceClient({auth});

  const text = 'Hello, world!';

  const [response] = await language.analyzeSentiment({
    document: {
      content: text,
      type: 'PLAIN_TEXT',
    },
  });

  console.log(`Text: ${text}`);
  console.log(
    `Sentiment: ${response.documentSentiment.score}, ${response.documentSentiment.magnitude}`,
  );
  console.log('Successfully authenticated using the API key');
}

authenticateWithAPIKey();

Python

์ด ์ƒ˜ํ”Œ์„ ์‹คํ–‰ํ•˜๋ ค๋ฉด Natural Language ํด๋ผ์ด์–ธํŠธ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋ฅผ ์„ค์น˜ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.


from google.cloud import language_v1


def authenticate_with_api_key(api_key_string: str) -> None:
    """
    Authenticates with an API key for Google Language service.

    TODO(Developer): Replace this variable before running the sample.

    Args:
        api_key_string: The API key to authenticate to the service.
    """

    # Initialize the Language Service client and set the API key
    client = language_v1.LanguageServiceClient(
        client_options={"api_key": api_key_string}
    )

    text = "Hello, world!"
    document = language_v1.Document(
        content=text, type_=language_v1.Document.Type.PLAIN_TEXT
    )

    # Make a request to analyze the sentiment of the text.
    sentiment = client.analyze_sentiment(
        request={"document": document}
    ).document_sentiment

    print(f"Text: {text}")
    print(f"Sentiment: {sentiment.score}, {sentiment.magnitude}")
    print("Successfully authenticated using the API key")

์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์—์„œ API ํ‚ค๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์ €์žฅ ๋ฐ ์ „์†ก ์ค‘์— ์•ˆ์ „ํ•˜๊ฒŒ ๋ณดํ˜ธ๋˜๋„๋ก ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. API ํ‚ค๋ฅผ ๊ณต๊ฐœ์ ์œผ๋กœ ๋…ธ์ถœํ•˜๋ฉด ๊ณ„์ •์— ์˜ˆ์ƒ์น˜ ์•Š์€ ๋น„์šฉ์ด ๋ถ€๊ณผ๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ž์„ธํ•œ ๋‚ด์šฉ์€ API ํ‚ค ๊ด€๋ฆฌ ๊ถŒ์žฅ์‚ฌํ•ญ์„ ์ฐธ์กฐํ•˜์„ธ์š”.

์™ธ๋ถ€ ์†Œ์Šค ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์„ ์‚ฌ์šฉํ•  ๋•Œ์˜ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ

์ผ๋ฐ˜์ ์œผ๋กœ gcloud CLI ๋ช…๋ น์–ด๋ฅผ ์‚ฌ์šฉํ•˜๊ฑฐ๋‚˜ Google Cloud ์ฝ˜์†”์„ ์‚ฌ์šฉํ•˜์—ฌ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์„ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด gcloud CLI๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ๋กœ์ปฌ ADC ํŒŒ์ผ์ด๋‚˜ ๋กœ๊ทธ์ธ ๊ตฌ์„ฑ ํŒŒ์ผ์„ ์ƒ์„ฑํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋งˆ์ฐฌ๊ฐ€์ง€๋กœ Google Cloud ์ฝ˜์†”์„ ์‚ฌ์šฉํ•˜์—ฌ ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค๋ฅผ ๋งŒ๋“ค๊ณ  ๋‹ค์šด๋กœ๋“œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๊ทธ๋Ÿฌ๋‚˜ ์ผ๋ถ€ ์‚ฌ์šฉ ์‚ฌ๋ก€์—์„œ๋Š” ์™ธ๋ถ€ ๋ฒ•์ธ์ด ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์ด๋Ÿฌํ•œ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์€ Google API์— ์ธ์ฆํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค.

์ผ๋ถ€ ์œ ํ˜•์˜ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์—๋Š” ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๊ฐ€ ํ† ํฐ์„ ํš๋“ํ•˜๋Š” ๋ฐ ์‚ฌ์šฉํ•˜๋Š” ์—”๋“œํฌ์ธํŠธ์™€ ํŒŒ์ผ ๊ฒฝ๋กœ๊ฐ€ ํฌํ•จ๋ฉ๋‹ˆ๋‹ค. ์™ธ๋ถ€ ์†Œ์Šค์˜ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์„ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ตฌ์„ฑ์„ ์‚ฌ์šฉํ•˜๊ธฐ ์ „์— ๊ตฌ์„ฑ์„ ๊ฒ€์‚ฌํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ๊ตฌ์„ฑ์„ ๊ฒ€์‚ฌํ•˜์ง€ ์•Š์œผ๋ฉด ์•…์˜์ ์ธ ํ–‰์œ„์ž๊ฐ€ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์‹œ์Šคํ…œ๊ณผ ๋ฐ์ดํ„ฐ์˜ ๋ณด์•ˆ์„ ์นจํ•ดํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์™ธ๋ถ€ ์†Œ์Šค์˜ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ ๊ฒ€์‚ฌ

์™ธ๋ถ€ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด๋ฅผ ๊ฒ€์‚ฌํ•˜๋Š” ๋ฐฉ๋ฒ•์€ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์—์„œ ํ—ˆ์šฉํ•˜๋Š” ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ์œ ํ˜•์— ๋”ฐ๋ผ ๋‹ค๋ฆ…๋‹ˆ๋‹ค.

์„œ๋น„์Šค ๊ณ„์ • ํ‚ค ๊ฒ€์‚ฌ

์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค๋งŒ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๋‹ค์Œ ์˜ˆ์™€ ๊ฐ™์ด ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค ์ „์šฉ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๋กœ๋”๋ฅผ ์‚ฌ์šฉํ•˜์„ธ์š”. ์œ ํ˜•๋ณ„ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๋กœ๋”๋Š” ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค์— ์žˆ๋Š” ํ•„๋“œ๋งŒ ํŒŒ์‹ฑํ•˜์—ฌ ์ทจ์•ฝ์ ์„ ๋…ธ์ถœํ•˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค.

C#

var saCredential = ServiceAccountCredential.FromServiceAccountData(stream);

C++

auto cred = google::cloud::MakeServiceAccountCredentials(json)

์ž๋ฐ”

ServiceAccountCredentials credentials =
      ServiceAccountCredentials.fromStream(credentialsStream);

Node.js

const keys = JSON.parse(json_input)
const authClient = JWT.fromJSON(keys);

PHP

cred = new Google\Auth\Credentials\ServiceAccountCredentials($scope, $jsonKey);

Python

cred = service_account.Credentials.from_service_account_info(json_data)

Ruby

creds = Google::Auth::ServiceAccountCredentials.make_creds(json_key_io: json_stream)

์œ ํ˜•๋ณ„ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๋กœ๋”๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ type ํ•„๋“œ์˜ ๊ฐ’์ด service_account์ธ์ง€ ํ™•์ธํ•˜์—ฌ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด๋ฅผ ๊ฒ€์‚ฌํ•ฉ๋‹ˆ๋‹ค. type ํ•„๋“œ์˜ ๊ฐ’์ด ๋‹ค๋ฅธ ๊ฐ’์ธ ๊ฒฝ์šฐ ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค๋ฅผ ์‚ฌ์šฉํ•˜์ง€ ๋งˆ์„ธ์š”.

๊ธฐํƒ€ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ ๊ฒ€์‚ฌ

์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์„œ๋น„์Šค ๊ณ„์ • ํ‚ค ์™ธ์— ๋ชจ๋“  ์œ ํ˜•์˜ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด๋ฅผ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์ถ”๊ฐ€ ๊ฒ€์‚ฌ๋ฅผ ์ˆ˜ํ–‰ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ๋‹ค๋ฅธ ์œ ํ˜•์˜ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์˜ ์˜ˆ๋กœ๋Š” ADC ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ํŒŒ์ผ, ์›Œํฌ๋กœ๋“œ ์•„์ด๋ดํ‹ฐํ‹ฐ ์ œํœด ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ํŒŒ์ผ ๋˜๋Š” ์ง์› ID ์ œํœด ๋กœ๊ทธ์ธ ๊ตฌ์„ฑ ํŒŒ์ผ์ด ์žˆ์Šต๋‹ˆ๋‹ค.

๋‹ค์Œ ํ‘œ์—๋Š” ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด์— ์žˆ๋Š” ๊ฒฝ์šฐ ๊ฒ€์‚ฌํ•ด์•ผ ํ•˜๋Š” ํ•„๋“œ๊ฐ€ ๋‚˜์™€ ์žˆ์Šต๋‹ˆ๋‹ค. ์ผ๋ถ€ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ •๋ณด ๊ตฌ์„ฑ์—๋Š” ์ด๋Ÿฌํ•œ ํ•„๋“œ๊ฐ€ ๋ชจ๋‘ ํ‘œ์‹œ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค.

ํ•„๋“œ ๋ชฉ์  ์˜ˆ์ƒ ๊ฐ’
service_account_impersonation_url ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ด ํ•„๋“œ๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์—”๋“œํฌ์ธํŠธ์— ์•ก์„ธ์Šคํ•˜์—ฌ ๊ฐ€์žฅ๋œ ์„œ๋น„์Šค ๊ณ„์ •์˜ ์•ก์„ธ์Šค ํ† ํฐ์„ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค. https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/service account email:generateAccessToken
token_url ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์™ธ๋ถ€ ํ† ํฐ์„ ์ด ์—”๋“œํฌ์ธํŠธ๋กœ ์ „์†กํ•˜์—ฌ ์ œํœด ์•ก์„ธ์Šค ํ† ํฐ์œผ๋กœ ๊ตํ™˜ํ•ฉ๋‹ˆ๋‹ค. https://sts.googleapis.com/v1/token
credential_source.file ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ด ํ•„๋“œ์— ์ง€์ •๋œ ์œ„์น˜์˜ ํŒŒ์ผ์—์„œ ์™ธ๋ถ€ ํ† ํฐ์„ ์ฝ๊ณ  token_url ์—”๋“œํฌ์ธํŠธ๋กœ ์ „์†กํ•ฉ๋‹ˆ๋‹ค. ์™ธ๋ถ€ ํ† ํฐ์ด ํฌํ•จ๋œ ํŒŒ์ผ์˜ ๊ฒฝ๋กœ์ž…๋‹ˆ๋‹ค. ์ด ๊ฒฝ๋กœ๋ฅผ ์•Œ์•„์•ผ ํ•ฉ๋‹ˆ๋‹ค.
credential_source.url ์™ธ๋ถ€ ํ† ํฐ์„ ๋ฐ˜ํ™˜ํ•˜๋Š” ์—”๋“œํฌ์ธํŠธ์ž…๋‹ˆ๋‹ค. ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ด URL์— ์š”์ฒญ์„ ๋ณด๋‚ด๊ณ  ์‘๋‹ต์„ token_url ์—”๋“œํฌ์ธํŠธ๋กœ ์ „์†กํ•ฉ๋‹ˆ๋‹ค.

๋‹ค์Œ ํ•ญ๋ชฉ ์ค‘ ํ•˜๋‚˜์ž…๋‹ˆ๋‹ค.

  • ํด๋ผ์šฐ๋“œ ์ œ๊ณต์—…์ฒด์—์„œ ์ œ๊ณตํ•˜๋Š” ์ž˜ ์•Œ๋ ค์ง„ ์—”๋“œํฌ์ธํŠธ์ž…๋‹ˆ๋‹ค.
  • ํ† ํฐ์„ ์ œ๊ณตํ•˜๋„๋ก ๋ช…์‹œ์ ์œผ๋กœ ์„ค์ •ํ•œ ์—”๋“œํฌ์ธํŠธ์ž…๋‹ˆ๋‹ค.
credential_source.executable.command GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES ํ™˜๊ฒฝ ๋ณ€์ˆ˜๊ฐ€ 1๋กœ ์„ค์ •๋˜๋ฉด ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๊ฐ€ ์ด ๋ช…๋ น์–ด ๋˜๋Š” ์‹คํ–‰ ํŒŒ์ผ์„ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค. ์™ธ๋ถ€ ํ† ํฐ์„ ๋ฐ˜ํ™˜ํ•˜๋Š” ์‹คํ–‰ ํŒŒ์ผ ๋˜๋Š” ๋ช…๋ น์–ด์ž…๋‹ˆ๋‹ค. ์ด ๋ช…๋ น์–ด๋ฅผ ์•Œ์•„๋ณด๊ณ  ์•ˆ์ „ํ•œ์ง€ ๊ฒ€์‚ฌํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.
credential_source.aws.url ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ด URL์— ์š”์ฒญ์„ ๋ณด๋‚ด AWS ๋ณด์•ˆ ํ† ํฐ์„ ๊ฐ€์ ธ์˜ต๋‹ˆ๋‹ค.

์ •ํ™•ํžˆ ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๊ฐ’ ์ค‘ ํ•˜๋‚˜์ž…๋‹ˆ๋‹ค.

  • http://169.254.169.254/latest/meta-data/iam/security-credentials
  • http://[fd00:ec2::254]/latest/meta-data/iam/security-credentials
credential_source.aws.region_url ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ด URL์— ์š”์ฒญ์„ ๋ณด๋‚ด ํ™œ์„ฑ AWS ๋ฆฌ์ „์„ ๊ฐ€์ ธ์˜ต๋‹ˆ๋‹ค.

์ •ํ™•ํžˆ ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๊ฐ’ ์ค‘ ํ•˜๋‚˜์ž…๋‹ˆ๋‹ค.

  • http://169.254.169.254/latest/meta-data/placement/availability-zone
  • http://[fd00:ec2::254]/latest/meta-data/placement/availability-zone
credential_source.aws.imdsv2_session_token_url ์ธ์ฆ ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ๋Š” ์ด URL์— ์š”์ฒญ์„ ๋ณด๋‚ด AWS ์„ธ์…˜ ํ† ํฐ์„ ๊ฐ€์ ธ์˜ต๋‹ˆ๋‹ค.

์ •ํ™•ํžˆ ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๊ฐ’ ์ค‘ ํ•˜๋‚˜์ž…๋‹ˆ๋‹ค.

  • http://169.254.169.254/latest/api/token
  • http://[fd00:ec2::254]/latest/api/token

๋‹ค์Œ ๋‹จ๊ณ„