If I impersonate the SA by ACCESS_TOKEN=$(gcloud auth print-access-token --impersonate-service-account=secops-sa@project-here.iam.gserviceaccount.com --scopes="https://www.googleapis.com/auth/cloud-platform") and fetch the instance data by curl -H "Authorization: Bearer $ACCESS_TOKEN" "https://chronicle.us.rep.googleapis.com/v1beta/projects/123456789012/locations/us/instances/1a1a1a1a-1a1a-1a1a-1a1a-1a1a1a1a1a1a/", the request is successful and the response contains the wanted data.
However, if I attempt to curl -H "Authorization: Bearer $ACCESS_TOKEN" "https://chronicle.us.rep.googleapis.com/v1beta/projects/123456789012/locations/us/instances/1a1a1a1a-1a1a-1a1a-1a1a-1a1a1a1a1a1a/cases", the response is
{
"error": {
"code": 401,
"message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
"status": "UNAUTHENTICATED"
}
}
Looks like the v1 API works with the impersonation, but most of the resources under v1beta and v1alpha do not and we get the error message. If I use my own GCP identity (which is a Chronicle admin) the request curl -H "Authorization: Bearer $ACCESS_TOKEN" "https://chronicle.us.rep.googleapis.com/v1beta/projects/123456789012/locations/us/instances/1a1a1a1a-1a1a-1a1a-1a1a-1a1a1a1a1a1a/cases" works (after ACCESS_TOKEN=$(gcloud auth print-access-token)). I also gave the SA the same privileges to Chronicle as I have (an IAM role) and that did not solve the issue.
There may be some small changes in authentication & authorization between e.g. v1 and v1beta when using SA impersonation. What these would be? Are there some workarounds, tricks or tips for fixing this issue? The intent is to develop a small tool which runs in Cloud Functions. If SA impersonation does not work in dev env from dev endpoint, I'm not sure if it will work from a Cloud Function either.
I have ensured that the SA has the necessary (GCP IAM) permissions for accessing the cases resource. Chronicle API access should be controllable with GCP IAM.
