Google Cloud新手（原AWS用户）咨询客户端Pub/Sub注册方案

Hey there! Since you're making the switch from AWS to GCP and building a userless app with multiple client instances, let's walk through how to set up that registration flow using Cloud Functions and Pub/Sub. Here's a practical breakdown tailored to your needs:

Core Approach #

The goal is to have each client instance register via a Cloud Function, which will:

• Create a unique Pub/Sub topic exclusively for that client
• Provision credentials that only allow that client to subscribe to its topic
• Return those credentials to the client for future use

Step-by-Step Implementation #

1. Cloud Function Setup & Dependencies #

First, make sure your Cloud Function has the necessary dependencies installed. For Node.js, your package.json should include:

{
  "dependencies": {
    "@google-cloud/pubsub": "^4.0.0",
    "googleapis": "^120.0.0"
  }
}

2. The Registration Function Code #

Here’s a working example of the Cloud Function that handles client registration. It generates a unique client ID, creates a dedicated topic, provisions a service account with subscriber permissions, and returns credentials:

const { PubSub } = require('@google-cloud/pubsub');
const { google } = require('googleapis');
const crypto = require('crypto');

const pubsub = new PubSub();
const iam = google.iam('v1');

exports.registerClient = async (req, res) => {
  // Generate a unique client ID (you could also accept a client-provided ID if preferred)
  const clientId = crypto.randomUUID();
  const topicName = `client-exclusive-topic-${clientId}`;
  const projectId = process.env.GCP_PROJECT;

  try {
    // 1. Create the dedicated Pub/Sub topic
    const [topic] = await pubsub.createTopic(topicName);
    console.log(`Created exclusive topic: ${topic.name}`);

    // 2. Create a service account for this specific client
    const serviceAccountId = `client-sa-${clientId}`;
    const serviceAccountEmail = `${serviceAccountId}@${projectId}.iam.gserviceaccount.com`;

    // Authenticate for IAM operations
    const auth = await google.auth.getClient({
      scopes: ['https://www.googleapis.com/auth/cloud-platform'],
    });
    google.options({ auth });

    await iam.projects.serviceAccounts.create({
      name: `projects/${projectId}`,
      requestBody: {
        accountId: serviceAccountId,
        serviceAccount: { displayName: `Client ${clientId} Service Account` }
      }
    });

    // 3. Grant the service account SUBSCRIBER access to the new topic
    const policy = await topic.iam.getPolicy();
    policy.bindings.push({
      role: 'roles/pubsub.subscriber',
      members: [`serviceAccount:${serviceAccountEmail}`]
    });
    await topic.iam.setPolicy(policy);

    // 4. Generate a service account key (for client authentication)
    const [key] = await iam.projects.serviceAccounts.keys.create({
      name: `projects/${projectId}/serviceAccounts/${serviceAccountEmail}`,
      requestBody: {
        privateKeyType: 'TYPE_GOOGLE_CREDENTIALS_FILE',
        keyAlgorithm: 'KEY_ALG_RSA_2048'
      }
    });

    // 5. Return credentials to the client
    res.status(200).json({
      clientId,
      topicId: topicName,
      serviceAccountEmail,
      // The private key is base64 encoded; client will need to decode it to use
      credentials: key.privateKeyData
    });

  } catch (error) {
    console.error('Registration failed:', error);
    res.status(500).json({ error: 'Failed to register client. Please try again.' });
  }
};

3. Critical Permissions for the Cloud Function #

The service account running your Cloud Function needs these IAM roles to perform all the steps above:

• roles/pubsub.admin (to create topics and manage their IAM policies)
• roles/iam.serviceAccountAdmin (to create service accounts)
• roles/iam.serviceAccountKeyAdmin (to generate service account keys)

Production Best Practices #

• Secure Credential Delivery: Instead of returning the private key directly, store it in Secret Manager and return a secret name to the client. Then grant the client’s service account access to that secret. This avoids exposing sensitive keys in API responses.
• Clean Up Idle Resources: Set up a cron job or Cloud Function to delete unused topics and service accounts after a period of inactivity to avoid unnecessary costs.
• Authentication for Registration: Add a layer of authentication to your registration endpoint (e.g., API key, mutual TLS) to prevent unauthorized clients from registering.

AWS-to-GCP Context #

If you’re mapping from AWS concepts:

• Pub/Sub topics = SNS topics
• Service accounts = IAM users/roles (with dedicated credentials)
• Cloud Functions = Lambda functions

内容的提问来源于stack exchange，提问作者Kamil Janowski