Support signurl using compute engine service account

Hi! I noticed in #968 there was functionality added to create signed URLs without a local private key. That’s awesome! I’m trying to use this and I could use a little help.

I’m running on a compute instance and I’m able to do things like list the contents of my bucket without setting up any special configuration using the default service account, but trying to create a signed URL results in this message:

$ gsutil signurl -d 10m -u gs://[snip]/[snip].zip
URL     HTTP Method     Expiration      Signed URL
CommandException: Cannot get service account email id for the given credential type.

I’m guessing I need to set up a boto config, though I haven’t had to do that for other actions. Is there anything you could suggest?

I’m using gsutil 4.49.

Thank you!

[dilipped]

Edited the title to better describe the exact feature that is needed here.

On digging a little more into this problem, it looks like the fix is not as simple as I thought earlier. GceAssertionCredentials (which is what gets used if using the default setup from a GCE instance) does not provide service_account_email directly which is required for signing the url.

We might have to figure out other ways to access the service account email which would need further exploring the API. A quick look here shows that currently there is no good way to extract that information.

[dilipped]

You can run gsutil version -l to check the boto config path.