Expand description
Google Cloud credentials — service-account impersonation, downscoped Cloud Storage tokens, and HMAC keys.
GCP can mint short-lived credentials and, uniquely among the clouds here,
can narrow one to a single bucket and prefix at mint time via a Credential
Access Boundary. What it cannot do is revoke one: an issued access token is
valid until expireTime no matter what happens in IAM. So the headline
shape is B — scope and TTL are the whole containment story — with HMAC keys
as the one genuinely revocable option.
See docs/delegation/gcp-storage.md for the mechanism.
Structs§
Enums§
- Credential
Type - Which mechanism a role mints. The three differ in what they can be narrowed to and — more importantly — whether they can be revoked.
- GcpAuth
- How the server proves its own identity to Google before it can impersonate anything.