Allow credential impersonation

Would like to use service account impersonation.

I’ve executed gcloud auth application-default login --impersonate-service-account=<name>@<project>.iam.gserviceaccount.com.

Currently, using the library throws:

    raise exceptions.DefaultCredentialsError(
google.auth.exceptions.DefaultCredentialsError: The file /home/gcg/.config/gcloud/application_default_credentials.json does not have a valid type. Type is impersonated_service_account, expected one of ('authorized_user', 'service_account', 'external_account').

[jackwotherspoon]

@gunar The gcloud command you stated above should now work with the connector to support impersonated credentials. The latest version of the google-auth package added support for this feature.

To get access to the latest version of the connector with the new change prior to an official release run: pip install git+https://github.com/GoogleCloudPlatform/cloud-sql-python-connector

Or you can use the version of the connector you already have installed and just update the google-auth package directly. pip install google-auth==2.6.0

Hope this helps! Thanks for raising this issue and have a great day.

[jackwotherspoon]

@gunar Not fully no. You can now pass in a credentials object to a custom connector.Connector() object that will use the specified credentials to authenticate instead of default credentials. So theoretically yes you could pass in an impersonated credentials using the following method google.auth.impersonated_credentials.

I will be adding support for the gcloud command that you mentioned above to work natively with the connector in the coming weeks. Hope that clarifies it! Thanks for asking 😃

All the best.