Bitbucket Pipelines与GCP OIDC集成权限错误求助

错误信息 #

ERROR: (gcloud.storage.buckets.list) There was a problem refreshing your current auth tokens: ('Unable to acquire impersonated credentials', '{
  "error": {
    "code": 403,
    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "IAM_PERMISSION_DENIED",
        "domain": "iam.googleapis.com",
        "metadata": {
          "permission": "iam.serviceAccounts.getAccessToken"
        }
      }
    ]
  }
}
')

Please run:
  $ gcloud auth login
to obtain new credentials.
If you have already logged in with a different account, run:
  $ gcloud config set account ACCOUNT
to select an already authenticated account to use. 

已执行的配置步骤 #

• 1. 创建Workload Identity Pool：

gcloud beta iam workload-identity-pools create bitbucket-pipelines-oidc-demo \
  --location="global" \
  --description="A workload identity pool for Bitbucket Pipelines" \
  --display-name="bitbucket-pipelines-oidc-demo" 

• 2. 创建OIDC Provider：

gcloud beta iam workload-identity-pools providers create-oidc bitbucket-oidc-idp \
  --workload-identity-pool="bitbucket-pipelines-oidc-demo" \
  --issuer-uri="https://api.bitbucket.org/2.0/workspaces/my-workspace/pipelines-config/identity/oidc" \
  --location="global" \
  --attribute-mapping="google.subject=assertion.sub,attribute.workspace_uuid=assertion.workspaceUuid" \
  --allowed-audiences="ari:cloud:bitbucket::workspace/my-workspace-uuid"

• 3. 创建Service Account：

gcloud iam service-accounts create my-service-account \
  --display-name="Service account for OIDC integration"

• 4. 绑定Service Account到Workload Identity Pool：

gcloud iam service-accounts add-iam-policy-binding my-service-account@my-project.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/my-project-number/locations/global/workloadIdentityPools/bitbucket-pipelines-oidc-demo/attribute.workspace_uuid/my-workspace-uuid"

• 5. 授予存储查看权限：

gcloud projects add-iam-policy-binding my-project \
 --member="serviceAccount:my-service-account@my-project.iam.gserviceaccount.com" \
 --role="roles/storage.viewer"

• 6. 配置serviceAccountTokenCreator角色：

gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:my-service-account@my-project.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

• 7. Bitbucket Pipeline配置（bitbucket-pipelines.yml）：

image: google/cloud-sdk:alpine

pipelines:
  default:
    - step:
        name: Test OIDC with GCP
        oidc: true
        script:
          # Save OIDC token to a file
          - echo -n "${BITBUCKET_STEP_OIDC_TOKEN}" > /tmp/gcp_access_token.out

          # Create GCP credentials
          - |
            gcloud iam workload-identity-pools create-cred-config \
              projects/my-project-number/locations/global/workloadIdentityPools/bitbucket-pipelines-oidc-demo/providers/bitbucket-oidc-idp \
              --service-account="my-service-account@my-project.iam.gserviceaccount.com" \
              --output-file=/tmp/sts-creds.json \
              --credential-source-file=/tmp/gcp_access_token.out

          # Export credentials
          - export GOOGLE_APPLICATION_CREDENTIALS=/tmp/sts-creds.json

          # Authenticate and list buckets
          - gcloud auth login --cred-file=/tmp/sts-creds.json
          - gcloud storage buckets list

观察到的问题 #

• 管道执行gcloud storage buckets list时失败，返回上述403错误
• 服务账号似乎缺少获取iam.serviceAccounts.getAccessToken的权限

疑问 #

1. 配置中是否遗漏了权限或角色？
2. 管道中的凭证生成/传递方式是否有问题？
3. OIDC令牌可能存在问题吗？如何调试？

1. 权限配置修正 #

核心问题是**iam.serviceAccounts.getAccessToken权限的授予对象错误**：

• roles/iam.serviceAccountTokenCreator角色需要授予给通过OIDC验证的外部主体（即Bitbucket工作空间的OIDC身份），而非服务账号本身。这个角色允许外部主体请求服务账号的访问令牌，不是让服务账号自己调用API。
• 执行以下命令修正权限绑定：

gcloud iam service-accounts add-iam-policy-binding my-service-account@my-project.iam.gserviceaccount.com \
  --role="roles/iam.serviceAccountTokenCreator" \
  --member="principalSet://iam.googleapis.com/projects/my-project-number/locations/global/workloadIdentityPools/bitbucket-pipelines-oidc-demo/attribute.workspace_uuid/my-workspace-uuid"

• 步骤4中roles/iam.workloadIdentityUser的绑定是正确的，无需修改，它允许外部主体模拟服务账号。

2. 管道凭证传递优化 #

脚本存在冗余步骤，可能导致凭证冲突：

• 无需执行gcloud auth login --cred-file=/tmp/sts-creds.json，GOOGLE_APPLICATION_CREDENTIALS环境变量会被gcloud CLI自动读取。
• 修正后的管道脚本：

image: google/cloud-sdk:alpine

pipelines:
  default:
    - step:
        name: Test OIDC with GCP
        oidc: true
        script:
          # 直接使用环境变量中的OIDC令牌创建凭证配置，无需写入文件
          - |
            gcloud iam workload-identity-pools create-cred-config \
              projects/my-project-number/locations/global/workloadIdentityPools/bitbucket-pipelines-oidc-demo/providers/bitbucket-oidc-idp \
              --service-account="my-service-account@my-project.iam.gserviceaccount.com" \
              --output-file=/tmp/sts-creds.json \
              --credential-source-env=BITBUCKET_STEP_OIDC_TOKEN

          # 导出凭证路径
          - export GOOGLE_APPLICATION_CREDENTIALS=/tmp/sts-creds.json

          # 直接执行存储桶列表命令
          - gcloud storage buckets list

3. OIDC令牌调试方法 #

若权限和脚本修正后仍有问题，按以下步骤调试：

• 在Pipeline中添加步骤打印令牌内容（注意：令牌含敏感信息，仅用于调试，完成后删除）：

- echo "${BITBUCKET_STEP_OIDC_TOKEN}" | base64 -d | jq .

• 检查令牌字段：
  • aud必须匹配GCP OIDC Provider中配置的allowed-audiences值（ari:cloud:bitbucket::workspace/my-workspace-uuid）
  • workspaceUuid必须与IAM策略绑定中使用的my-workspace-uuid一致
• 使用GCP命令验证令牌有效性：

gcloud iam workload-identity-pools verify-oidc \
  --oidc-token="${BITBUCKET_STEP_OIDC_TOKEN}" \
  --issuer-uri="https://api.bitbucket.org/2.0/workspaces/my-workspace/pipelines-config/identity/oidc" \
  --workload-identity-pool="bitbucket-pipelines-oidc-demo" \
  --location="global"

内容的提问来源于stack exchange，提问作者Jose A. Matarán