管理服务帐号的 HMAC 密钥

本页介绍如何创建、停用和删除与项目中的服务帐号关联的基于哈希的消息身份验证代码 (HMAC)。如需了解一般信息,请参阅 HMAC 密钥

前提条件

在 Cloud Storage 中使用此功能之前,您应该先做好以下准备:

  1. 确保拥有的权限足以支持在所需项目中使用 HMAC 密钥:

    • 如果您拥有该项目,那么您很可能已具备必要的权限。

    • 您应对该项目拥有前缀为 storage.hmacKeys 的 IAM 权限。如需了解如何获取具有这些权限的角色(例如 roles/storage.hmacKeyAdmin),请参阅使用 IAM 权限

  2. 您的项目应包含一个您要为其创建 HMAC 密钥的服务帐号。如果您目前还没有服务帐号,请参阅创建服务帐号

创建 HMAC 密钥

如需为服务帐号创建 HMAC 密钥,请执行以下操作:

控制台

  1. 在 Google Cloud Platform Console 中打开 Cloud Storage 浏览器。
    打开 Cloud Storage 浏览器
  2. 点击设置

  3. 选择互操作标签页。

  4. 点击 + 为服务帐号创建密钥

  5. 选择要与 HMAC 密钥相关联的服务帐号。

  6. 点击创建密钥

gsutil

使用 hmac create 命令,将 [VALUES_IN_BRACKETS] 替换为适当的值:

gsutil hmac create [SERVICE_ACCOUNT_EMAIL]

如果成功,响应将如下所示:

AccessId: GOOGTS7C7FUP3AIRVJTE2BCD
SecretKey: de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9

代码示例

C++

如需了解详情,请参阅 Cloud Storage C++ API 参考文档

namespace gcs = google::cloud::storage;
using ::google::cloud::StatusOr;
[](gcs::Client client, std::string service_account_email) {
  StatusOr<std::pair<gcs::HmacKeyMetadata, std::string>> hmac_key_details =
      client.CreateHmacKey(service_account_email);

  if (!hmac_key_details) {
    throw std::runtime_error(hmac_key_details.status().message());
  }
  std::cout << "The base64 encoded secret is: " << hmac_key_details->second
            << "\nDo not miss that secret, there is no API to recover it."
            << "\nThe HMAC key metadata is: " << hmac_key_details->first
            << "\n";
}

C#

如需了解详情,请参阅 Cloud Storage C# API 参考文档

        private void CreateHmacKey(String serviceAccountEmail)
        {
            var storage = StorageClient.Create();
            var key = storage.CreateHmacKey(s_projectId, serviceAccountEmail);

            var secret = key.Secret;
            var metadata = key.Metadata;

            Console.WriteLine($"The Base64 encoded secret is: {secret}");
            Console.WriteLine("Make sure to save that secret, there's no API to recover it.");
            Console.WriteLine("The HMAC key metadata is:");
            Console.WriteLine($"ID: {metadata.Id}");
            Console.WriteLine($"Access ID: {metadata.AccessId}");
            Console.WriteLine($"Project ID: {metadata.ProjectId}");
            Console.WriteLine($"Service Account Email: {metadata.ServiceAccountEmail}");
            Console.WriteLine($"State: {metadata.State}");
            Console.WriteLine($"Time Created: {metadata.TimeCreated}");
            Console.WriteLine($"Time Updated: {metadata.Updated}");
            Console.WriteLine($"ETag: {metadata.ETag}");
        }

Go

如需了解详情,请参阅 Cloud Storage Go API 参考文档

import (
	"cloud.google.com/go/storage"
	"context"
	"fmt"
	"io"
)

// createHMACKey creates a new HMAC key using the given project and service account.
func createHMACKey(w io.Writer, projectID string, serviceAccountEmail string) (*storage.HMACKey, error) {
	ctx := context.Background()

	// Initialize client.
	client, err := storage.NewClient(ctx)
	if err != nil {
		return nil, fmt.Errorf("storage.NewClient: %v", err)
	}
	defer client.Close() // Closing the client safely cleans up background resources.

	key, err := client.CreateHMACKey(ctx, projectID, serviceAccountEmail)
	if err != nil {
		return nil, fmt.Errorf("CreateHMACKey: %v", err)
	}

	fmt.Fprintf(w, "%s\n", key)
	fmt.Fprintf(w, "The base64 encoded secret is %s\n", key.Secret)
	fmt.Fprintln(w, "Do not miss that secret, there is no API to recover it.")
	fmt.Fprintln(w, "The HMAC key metadata is")
	fmt.Fprintf(w, "%+v", key)

	return key, nil
}

Java

如需了解详情,请参阅 Cloud Storage Java API 参考文档

// Instantiate a Google Cloud Storage client
Storage storage = StorageOptions.getDefaultInstance().getService();

// The service account email for which the new HMAC key will be created.
// String serviceAccountEmail = "service-account@iam.gserviceaccount.com";
//
// The ID of the project to which the service account belongs.
// String projectId = "project-id";

ServiceAccount account = ServiceAccount.of(serviceAccountEmail);
HmacKey hmacKey =
    storage.createHmacKey(account, Storage.CreateHmacKeyOption.projectId(projectId));

String secret = hmacKey.getSecretKey();
HmacKeyMetadata metadata = hmacKey.getMetadata();

System.out.println("The Base64 encoded secret is: " + secret);
System.out.println("Do not miss that secret, there is no API to recover it.");
System.out.println("The HMAC key metadata is:");
System.out.println("ID: " + metadata.getId());
System.out.println("Access ID: " + metadata.getAccessId());
System.out.println("Project ID: " + metadata.getProjectId());
System.out.println("Service Account Email: " + metadata.getServiceAccount().getEmail());
System.out.println("State: " + metadata.getState().toString());
System.out.println("Time Created: " + new Date(metadata.getCreateTime()).toString());
System.out.println("Time Updated: " + new Date(metadata.getUpdateTime()).toString());
System.out.println("ETag: " + metadata.getEtag());

Node.js

如需了解详情,请参阅 Cloud Storage Node.js API 参考文档

// Imports the Google Cloud client library
const {Storage} = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// Create HMAC SA Key
async function createHmacKey() {
  /**
   * TODO(developer): Uncomment the following line before running the sample.
   */
  // const serviceAccountEmail = 'Service Account Email to associate HMAC Key';
  // const projectId = 'The project Id this service account to be created in, e.g. serviceAccountProjectId';

  const [hmacKey, secret] = await storage.createHmacKey(serviceAccountEmail, {
    projectId,
  });

  console.log(`The base64 encoded secret is: ${secret}`);
  console.log(`Do not miss that secret, there is no API to recover it.`);
  console.log(`The HMAC key metadata is:`);
  for (const [key, value] of Object.entries(hmacKey.metadata)) {
    console.log(`${key}: ${value}`);
  }
}

PHP

如需了解详情,请参阅 Cloud Storage PHP API 参考文档

use Google\Cloud\Storage\StorageClient;

/**
 * Create a new HMAC key.
 *
 * @param string $serviceAccountEmail Service account email to associate with the new HMAC key.
 * @param string $projectId Google Cloud Project ID.
 *
 */
function create_hmac_key($serviceAccountEmail, $projectId)
{
    $storage = new StorageClient();
    // By default createHmacKey will use the projectId used by StorageClient().
    $hmacKeyCreated = $storage->createHmacKey($serviceAccountEmail, ['projectId' => $projectId]);

    printf('The base64 encoded secret is: %s' . PHP_EOL, $hmacKeyCreated->secret());
    print('Do not miss that secret, there is no API to recover it.' . PHP_EOL);
    printf('HMAC key Metadata: %s' . PHP_EOL, print_r($hmacKeyCreated->hmacKey()->info(), true));
}

Python

如需了解详情,请参阅 Cloud Storage Python API 参考文档

# project_id = 'Your Google Cloud project ID'
# service_account_email = 'Service account used to generate HMAC key'
storage_client = storage.Client(project=project_id)
hmac_key, secret = storage_client.create_hmac_key(
    service_account_email=service_account_email,
    project_id=project_id)
print('The base64 encoded secret is {}'.format(secret))
print('Do not miss that secret, there is no API to recover it.')
print('The HMAC key metadata is:')
print('Service Account Email: {}'.format(hmac_key.service_account_email))
print('Key ID: {}'.format(hmac_key.id))
print('Access ID: {}'.format(hmac_key.access_id))
print('Project ID: {}'.format(hmac_key.project))
print('State: {}'.format(hmac_key.state))
print('Created At: {}'.format(hmac_key.time_created))
print('Updated At: {}'.format(hmac_key.updated))
print('Etag: {}'.format(hmac_key.etag))

Ruby

如需了解详情,请参阅 Cloud Storage Ruby API 参考文档

# project_id = "Your Google Cloud project ID"
# service_account_email = "Service account used to associate generate HMAC key"

require "google/cloud/storage"

storage = Google::Cloud::Storage.new project_id: project_id

# By default Storage#create_hmac_key uses the Storage client project_id
hmac_key = storage.create_hmac_key service_account_email, project_id: project_id

puts "The base64 encoded secret is: #{hmac_key.secret}"
puts "Do not miss that secret, there is no API to recover it."
puts "\nThe HMAC key metadata is:"
puts "Key ID:                #{hmac_key.id}"
puts "Service Account Email: #{hmac_key.service_account_email}"
puts "Access ID:             #{hmac_key.access_id}"
puts "Project ID:            #{hmac_key.project_id}"
puts "Active:                #{hmac_key.active?}"
puts "Created At:            #{hmac_key.created_at}"
puts "Updated At:            #{hmac_key.updated_at}"
puts "Etag:                  #{hmac_key.etag}"

REST API

JSON API

  1. OAuth 2.0 Playground 获取授权访问令牌。将 Playground 配置为使用您自己的 OAuth 凭据。
  2. 使用 cURL,通过 POST hmacKeys 请求调用 JSON API,注意要将 [VALUES_IN_BRACKETS] 替换为适当的值:

    curl -X POST \
      -H "Authorization: Bearer [OAUTH2_TOKEN]" \
      "https://www.googleapis.com/storage/v1/projects/[PROJECT_ID]/hmacKeys?serviceAccountEmail=[SERVICE_ACCOUNT_EMAIL]"

XML API

XML API 不能用于创建 HMAC 密钥。请使用其他 Cloud Storage 工具,例如 gsutil。

获取 HMAC 密钥信息

如需列出项目的 HMAC 密钥并获取密钥的相关信息,请执行以下操作:

控制台

  1. 在 Google Cloud Platform Console 中打开 Cloud Storage 浏览器。
    打开 Cloud Storage 浏览器
  2. 点击设置

  3. 选择互操作标签页。

gsutil

  1. 使用 hmac list 命令列出项目中的 HMAC 密钥:

    gsutil hmac list

    如果成功,gsutil 将返回一个包含 HMAC 密钥访问 ID 以及各密钥的关联服务帐号的列表。

  2. 使用 hmac get 命令检索特定密钥的元数据:

    gsutil hmac get [KEY_ACCESS_ID] 

    其中,[KEY_ACCESS_ID] 是所需密钥的访问 ID。

代码示例

C++

如需了解详情,请参阅 Cloud Storage C++ API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

namespace gcs = google::cloud::storage;
using ::google::cloud::StatusOr;
[](gcs::Client client) {
  int count = 0;
  gcs::ListHmacKeysReader hmac_keys_list = client.ListHmacKeys();
  for (auto&& hmac_key_metadata : hmac_keys_list) {
    if (!hmac_key_metadata) {
      throw std::runtime_error(hmac_key_metadata.status().message());
    }
    std::cout << "service_account_email = "
              << hmac_key_metadata->service_account_email()
              << "\naccess_id = " << hmac_key_metadata->access_id() << "\n";
    ++count;
  }
  if (count == 0) {
    std::cout << "No HMAC keys in default project\n";
  }
}

以下示例检索特定 HMAC 密钥的信息:

namespace gcs = google::cloud::storage;
using ::google::cloud::StatusOr;
[](gcs::Client client, std::string access_id) {
  StatusOr<gcs::HmacKeyMetadata> hmac_key_details =
      client.GetHmacKey(access_id);

  if (!hmac_key_details) {
    throw std::runtime_error(hmac_key_details.status().message());
  }
  std::cout << "The HMAC key metadata is: " << *hmac_key_details << "\n";
}

C#

如需了解详情,请参阅 Cloud Storage C# API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

        private void ListHmacKeys()
        {
            var storage = StorageClient.Create();
            var keys = storage.ListHmacKeys(s_projectId);

            foreach (var metadata in keys)
            {
                Console.WriteLine($"Service Account Email: {metadata.ServiceAccountEmail}");
                Console.WriteLine($"Access ID: {metadata.AccessId}");
            }
        }

以下示例检索特定 HMAC 密钥的信息:

        private void GetHmacKey(String accessId)
        {
            var storage = StorageClient.Create();
            var metadata = storage.GetHmacKey(s_projectId, accessId);

            Console.WriteLine("The HMAC key metadata is:");
            Console.WriteLine($"ID: {metadata.Id}");
            Console.WriteLine($"Access ID: {metadata.AccessId}");
            Console.WriteLine($"Project ID: {metadata.ProjectId}");
            Console.WriteLine($"Service Account Email: {metadata.ServiceAccountEmail}");
            Console.WriteLine($"State: {metadata.State}");
            Console.WriteLine($"Time Created: {metadata.TimeCreated}");
            Console.WriteLine($"Time Updated: {metadata.Updated}");
            Console.WriteLine($"ETag: {metadata.ETag}");
        }

Go

如需了解详情,请参阅 Cloud Storage Go API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

import (
	"cloud.google.com/go/storage"
	"context"
	"fmt"
	"google.golang.org/api/iterator"
	"io"
)

// listHMACKeys lists all HMAC keys associated with the project.
func listHMACKeys(w io.Writer, projectID string) ([]*storage.HMACKey, error) {
	ctx := context.Background()

	// Initialize client.
	client, err := storage.NewClient(ctx)
	if err != nil {
		return nil, fmt.Errorf("storage.NewClient: %v", err)
	}
	defer client.Close() // Closing the client safely cleans up background resources.

	iter := client.ListHMACKeys(ctx, projectID)
	var keys []*storage.HMACKey
	for {
		key, err := iter.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return nil, fmt.Errorf("ListHMACKeys: %v", err)
		}
		fmt.Fprintf(w, "Service Account Email: %s\n", key.ServiceAccountEmail)
		fmt.Fprintf(w, "Access ID: %s\n", key.AccessID)

		keys = append(keys, key)
	}

	return keys, nil
}

以下示例检索特定 HMAC 密钥的信息:

import (
	"cloud.google.com/go/storage"
	"context"
	"fmt"
	"io"
)

// getHMACKey retrieves the HMACKeyMetadata with the given access id.
func getHMACKey(w io.Writer, accessID string, projectID string) (*storage.HMACKey, error) {
	ctx := context.Background()

	// Initialize client.
	client, err := storage.NewClient(ctx)
	if err != nil {
		return nil, fmt.Errorf("storage.NewClient: %v", err)
	}
	defer client.Close() // Closing the client safely cleans up background resources.

	handle := client.HMACKeyHandle(projectID, accessID)
	key, err := handle.Get(ctx)
	if err != nil {
		return nil, fmt.Errorf("Get: %v", err)
	}

	fmt.Fprintln(w, "The HMAC key metadata is:")
	fmt.Fprintf(w, "%+v", key)
	return key, nil
}

Java

如需了解详情,请参阅 Cloud Storage Java API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

// Instantiate a Google Cloud Storage client
Storage storage = StorageOptions.getDefaultInstance().getService();

// The ID of the project to which the service account belongs.
// String projectId = "project-id";
Page<HmacKeyMetadata> page = storage.listHmacKeys(ListHmacKeysOption.projectId(projectId));

for (HmacKeyMetadata metadata : page.iterateAll()) {
  System.out.println("Service Account Email: " + metadata.getServiceAccount().getEmail());
  System.out.println("Access ID: " + metadata.getAccessId());
}

以下示例检索特定 HMAC 密钥的信息:

// Instantiate a Google Cloud Storage client
Storage storage = StorageOptions.getDefaultInstance().getService();

// The access ID of the HMAC key, e.g. "GOOG0234230X00"
// String accessId = "GOOG0234230X00";
//
// The ID of the project to which the service account belongs.
// String projectId = "project-id";
HmacKeyMetadata metadata =
    storage.getHmacKey(accessId, Storage.GetHmacKeyOption.projectId(projectId));

System.out.println("The HMAC key metadata is:");
System.out.println("ID: " + metadata.getId());
System.out.println("Access ID: " + metadata.getAccessId());
System.out.println("Project ID: " + metadata.getProjectId());
System.out.println("Service Account Email: " + metadata.getServiceAccount().getEmail());
System.out.println("State: " + metadata.getState().toString());
System.out.println("Time Created: " + new Date(metadata.getCreateTime()).toString());
System.out.println("Time Updated: " + new Date(metadata.getUpdateTime()).toString());
System.out.println("ETag: " + metadata.getEtag());

Node.js

如需了解详情,请参阅 Cloud Storage Node.js API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

// Imports the Google Cloud client library
const {Storage} = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// List HMAC SA Keys' Metadata
async function listHmacKeys() {
  /**
   * TODO(developer): Uncomment the following line before running the sample.
   */
  // const projectId = 'The project Id this service account belongs to, e.g. serviceAccountProjectId';
  const [hmacKeys] = await storage.getHmacKeys({projectId});

  // hmacKeys is an array of HmacKey objects.
  for (const hmacKey of hmacKeys) {
    console.log(
      `Service Account Email: ${hmacKey.metadata.serviceAccountEmail}`
    );
    console.log(`Access Id: ${hmacKey.metadata.accessId}`);
  }
}

以下示例检索特定 HMAC 密钥的信息:

// Imports the Google Cloud client library
const {Storage} = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// Get HMAC SA Key Metadata
async function getHmacKey() {
  /**
   * TODO(developer): Uncomment the following line before running the sample.
   */
  // const hmacKeyAccessId = 'HMAC Access Key Id to get, e.g. GOOG0234230X00';
  // const projectId = 'The project Id this service account belongs to, e.g. serviceAccountProjectId';

  const hmacKey = storage.hmacKey(hmacKeyAccessId, {projectId});
  // Populate the hmacKey object with metadata from server.
  await hmacKey.getMetadata();

  console.log(`The HMAC key metadata is:`);
  for (const [key, value] of Object.entries(hmacKey.metadata)) {
    console.log(`${key}: ${value}`);
  }
}

PHP

如需了解详情,请参阅 Cloud Storage PHP API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

use Google\Cloud\Storage\StorageClient;

/**
 * List HMAC keys.
 *
 * @param string $projectId Google Cloud Project ID.
 *
 */
function list_hmac_keys($projectId)
{
    $storage = new StorageClient();
    // By default hmacKeys will use the projectId used by StorageClient() to list HMAC Keys.
    $hmacKeys = $storage->hmacKeys(['projectId' => $projectId]);

    printf('HMAC Key\'s:' . PHP_EOL);
    foreach ($hmacKeys as $hmacKey) {
        printf('Service Account Email: %s' . PHP_EOL, $hmacKey->info()['serviceAccountEmail']);
        printf('Access Id: %s' . PHP_EOL, $hmacKey->info()['accessId']);
    }
}

以下示例检索特定 HMAC 密钥的信息:

use Google\Cloud\Storage\StorageClient;

/**
 * Get an HMAC key.
 *
 * @param string $accessId Access ID for an HMAC key.
 * @param string $projectId Google Cloud Project ID.
 *
 */
function get_hmac_key($accessId, $projectId)
{
    $storage = new StorageClient();
    $hmacKey = $storage->hmacKey($accessId, $projectId);

    printf('HMAC key Metadata: %s' . PHP_EOL, print_r($hmacKey->info(), true));
}

Python

如需了解详情,请参阅 Cloud Storage Python API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

# project_id = 'Your Google Cloud project ID'
storage_client = storage.Client(project=project_id)
hmac_keys = storage_client.list_hmac_keys(project_id=project_id)
print('HMAC Keys:')
for hmac_key in hmac_keys:
    print('Service Account Email: {}'.format(
        hmac_key.service_account_email))
    print('Access ID: {}'.format(hmac_key.access_id))

以下示例检索特定 HMAC 密钥的信息:

# project_id = 'Your Google Cloud project ID'
# access_id = 'ID of an HMAC key'
storage_client = storage.Client(project=project_id)
hmac_key = storage_client.get_hmac_key_metadata(
    access_id,
    project_id=project_id)
print('The HMAC key metadata is:')
print('Service Account Email: {}'.format(hmac_key.service_account_email))
print('Key ID: {}'.format(hmac_key.id))
print('Access ID: {}'.format(hmac_key.access_id))
print('Project ID: {}'.format(hmac_key.project))
print('State: {}'.format(hmac_key.state))
print('Created At: {}'.format(hmac_key.time_created))
print('Updated At: {}'.format(hmac_key.updated))
print('Etag: {}'.format(hmac_key.etag))

Ruby

如需了解详情,请参阅 Cloud Storage Ruby API 参考文档

以下示例检索与项目关联的 HMAC 密钥列表:

# project_id = "Your Google Cloud project ID"

require "google/cloud/storage"

storage = Google::Cloud::Storage.new project_id: project_id

# By default Storage#hmac_keys uses the Storage client project_id
hmac_keys = storage.hmac_keys project_id: project_id

puts "HMAC Keys:"
hmac_keys.all do |hmac_key|
  puts "Service Account Email: #{hmac_key.service_account_email}"
  puts "Access ID: #{hmac_key.access_id}"
end

以下示例检索特定 HMAC 密钥的信息:

# project_id = "Your Google Cloud project ID"
# access_id = "ID of an HMAC key"

require "google/cloud/storage"

storage = Google::Cloud::Storage.new project_id: project_id

# By default Storage#hmac_keys uses the Storage client project_id
hmac_key = storage.hmac_key access_id, project_id: project_id

puts "The HMAC key metadata is:"
puts "Key ID:                #{hmac_key.id}"
puts "Service Account Email: #{hmac_key.service_account_email}"
puts "Access ID:             #{hmac_key.access_id}"
puts "Project ID:            #{hmac_key.project_id}"
puts "Active:                #{hmac_key.active?}"
puts "Created At:            #{hmac_key.created_at}"
puts "Updated At:            #{hmac_key.updated_at}"
puts "Etag:                  #{hmac_key.etag}"

REST API

JSON API

  1. OAuth 2.0 Playground 获取授权访问令牌。将 Playground 配置为使用您自己的 OAuth 凭据。
  2. 使用 cURL,通过 LIST hmacKeys 请求调用 JSON API,注意要将 [VALUES_IN_BRACKETS] 替换为适当的值:

    curl -X GET \
      -H "Authorization: Bearer [OAUTH2_TOKEN]" \
      -H "Content-Type: application/json" \
      "https://www.googleapis.com/storage/v1/projects/[PROJECT_ID]/hmacKeys"

XML API

XML API 不能用于获取或列出 HMAC 密钥。请使用其他 Cloud Storage 工具,例如 gsutil。

更新 HMAC 密钥的状态

如需切换 HMAC 密钥的活跃或非活跃状态,请执行以下操作:

控制台

  1. 在 Google Cloud Platform Console 中打开 Cloud Storage 浏览器。
    打开 Cloud Storage 浏览器
  2. 点击设置

  3. 选择互操作标签页。

  4. 点击与您要更新的密钥相关联的铅笔图标

  5. 点击与该密钥的状态关联的更多选项按钮 (“更多操作”图标。)。

  6. 选择要应用于该密钥的状态。

  7. 在出现的确认窗口中,确认您要更改该密钥的状态。

gsutil

使用 hmac update 命令,将 [VALUES_IN_BRACKETS] 替换为适当的值:

gsutil hmac update -s [STATE] [KEY_ACCESS_ID]

如果成功,gsutil 将返回更新后的 HMAC 密钥元数据。

代码示例

C++

如需了解详情,请参阅 Cloud Storage C++ API 参考文档

以下示例会停用 HMAC 密钥:

namespace gcs = google::cloud::storage;
using ::google::cloud::StatusOr;
[](gcs::Client client, std::string access_id) {
  StatusOr<gcs::HmacKeyMetadata> updated_metadata = client.UpdateHmacKey(
      access_id, gcs::HmacKeyMetadata().set_state(
                     gcs::HmacKeyMetadata::state_inactive()));

  if (!updated_metadata) {
    throw std::runtime_error(updated_metadata.status().message());
  }
  if (updated_metadata->state() != gcs::HmacKeyMetadata::state_inactive()) {
    throw std::runtime_error("The HMAC key is active, this is unexpected");
  }
  std::cout << "The HMAC key is now inactive\nFull metadata: "
            << *updated_metadata << "\n";
}

以下示例会激活 HMAC 密钥:

namespace gcs = google::cloud::storage;
using ::google::cloud::StatusOr;
[](gcs::Client client, std::string access_id) {
  StatusOr<gcs::HmacKeyMetadata> updated_metadata = client.UpdateHmacKey(
      access_id,
      gcs::HmacKeyMetadata().set_state(gcs::HmacKeyMetadata::state_active()));

  if (!updated_metadata) {
    throw std::runtime_error(updated_metadata.status().message());
  }
  if (updated_metadata->state() != gcs::HmacKeyMetadata::state_active()) {
    throw std::runtime_error(
        "The HMAC key is NOT active, this is unexpected");
  }
  std::cout << "The HMAC key is now active\nFull metadata: "
            << *updated_metadata << "\n";
}

C#

如需了解详情,请参阅 Cloud Storage C# API 参考文档

以下示例会停用 HMAC 密钥:

        private void DeactivateHmacKey(String accessId)
        {
            var storage = StorageClient.Create();
            var metadata = storage.GetHmacKey(s_projectId, accessId);
            metadata.State = HmacKeyStates.Inactive;
            var updatedMetadata = storage.UpdateHmacKey(metadata);

            Console.WriteLine("The HMAC key is now inactive.");
            Console.WriteLine("The HMAC key metadata is:");
            Console.WriteLine($"ID: {updatedMetadata.Id}");
            Console.WriteLine($"Access ID: {updatedMetadata.AccessId}");
            Console.WriteLine($"Project ID: {updatedMetadata.ProjectId}");
            Console.WriteLine($"Service Account Email: {updatedMetadata.ServiceAccountEmail}");
            Console.WriteLine($"State: {updatedMetadata.State}");
            Console.WriteLine($"Time Created: {updatedMetadata.TimeCreated}");
            Console.WriteLine($"Time Updated: {updatedMetadata.Updated}");
            Console.WriteLine($"ETag: {updatedMetadata.ETag}");
        }

以下示例会激活 HMAC 密钥:

        private void ActivateHmacKey(String accessId)
        {
            var storage = StorageClient.Create();
            var metadata = storage.GetHmacKey(s_projectId, accessId);
            metadata.State = HmacKeyStates.Active;
            var updatedMetadata = storage.UpdateHmacKey(metadata);

            Console.WriteLine("The HMAC key is now active.");
            Console.WriteLine("The HMAC key metadata is:");
            Console.WriteLine($"ID: {updatedMetadata.Id}");
            Console.WriteLine($"Access ID: {updatedMetadata.AccessId}");
            Console.WriteLine($"Project ID: {updatedMetadata.ProjectId}");
            Console.WriteLine($"Service Account Email: {updatedMetadata.ServiceAccountEmail}");
            Console.WriteLine($"State: {updatedMetadata.State}");
            Console.WriteLine($"Time Created: {updatedMetadata.TimeCreated}");
            Console.WriteLine($"Time Updated: {updatedMetadata.Updated}");
            Console.WriteLine($"ETag: {updatedMetadata.ETag}");
        }

Go

如需了解详情,请参阅 Cloud Storage Go API 参考文档

以下示例会停用 HMAC 密钥:

import (
	"cloud.google.com/go/storage"
	"context"
	"fmt"
	"io"
)

// deactivateHMACKey deactivates the HMAC key with the given access ID.
func deactivateHMACKey(w io.Writer, accessID string, projectID string) (*storage.HMACKey, error) {
	ctx := context.Background()

	// Initialize client.
	client, err := storage.NewClient(ctx)
	if err != nil {
		return nil, fmt.Errorf("storage.NewClient: %v", err)
	}
	defer client.Close() // Closing the client safely cleans up background resources.

	handle := client.HMACKeyHandle(projectID, accessID)
	key, err := handle.Update(ctx, storage.HMACKeyAttrsToUpdate{State: "INACTIVE"})
	if err != nil {
		return nil, fmt.Errorf("Update: %v", err)
	}

	fmt.Fprintln(w, "The HMAC key metadata is:")
	fmt.Fprintf(w, "%+v", key)

	return key, nil
}

以下示例会激活 HMAC 密钥:

import (
	"cloud.google.com/go/storage"
	"context"
	"fmt"
	"io"
)

// activateHMACKey activates the HMAC key with the given access ID.
func activateHMACKey(w io.Writer, accessID string, projectID string) (*storage.HMACKey, error) {
	ctx := context.Background()

	// Initialize client.
	client, err := storage.NewClient(ctx)
	if err != nil {
		return nil, fmt.Errorf("storage.NewClient: %v", err)
	}
	defer client.Close() // Closing the client safely cleans up background resources.

	handle := client.HMACKeyHandle(projectID, accessID)
	key, err := handle.Update(ctx, storage.HMACKeyAttrsToUpdate{State: "ACTIVE"})
	if err != nil {
		return nil, fmt.Errorf("Update: %v", err)
	}

	fmt.Fprintln(w, "The HMAC key metadata is:")
	fmt.Fprintf(w, "%+v", key)

	return key, nil
}

Java

如需了解详情,请参阅 Cloud Storage Java API 参考文档

以下示例会停用 HMAC 密钥:

// Instantiate a Google Cloud Storage client
Storage storage = StorageOptions.getDefaultInstance().getService();

// The access ID of the HMAC key, e.g. "GOOG0234230X00"
// String accessId = "GOOG0234230X00";
//
// The ID of the project to which the service account belongs.
// String projectId = "project-id";
HmacKeyMetadata metadata =
    storage.getHmacKey(accessId, Storage.GetHmacKeyOption.projectId(projectId));
HmacKeyMetadata newMetadata = storage.updateHmacKeyState(metadata, HmacKeyState.INACTIVE);

System.out.println("The HMAC key is now inactive.");
System.out.println("The HMAC key metadata is:");
System.out.println("ID: " + newMetadata.getId());
System.out.println("Access ID: " + newMetadata.getAccessId());
System.out.println("Project ID: " + newMetadata.getProjectId());
System.out.println("Service Account Email: " + newMetadata.getServiceAccount().getEmail());
System.out.println("State: " + newMetadata.getState().toString());
System.out.println("Time Created: " + new Date(newMetadata.getCreateTime()).toString());
System.out.println("Time Updated: " + new Date(newMetadata.getUpdateTime()).toString());
System.out.println("ETag: " + newMetadata.getEtag());

以下示例会激活 HMAC 密钥:

// Instantiate a Google Cloud Storage client
Storage storage = StorageOptions.getDefaultInstance().getService();

// The access ID of the HMAC key, e.g. "GOOG0234230X00"
// String accessId = "GOOG0234230X00";
//
// The ID of the project to which the service account belongs.
// String projectId = "project-id";
HmacKeyMetadata metadata =
    storage.getHmacKey(accessId, Storage.GetHmacKeyOption.projectId(projectId));
HmacKeyMetadata newMetadata = storage.updateHmacKeyState(metadata, HmacKeyState.ACTIVE);

System.out.println("The HMAC key is now active.");
System.out.println("The HMAC key metadata is:");
System.out.println("ID: " + newMetadata.getId());
System.out.println("Access ID: " + newMetadata.getAccessId());
System.out.println("Project ID: " + newMetadata.getProjectId());
System.out.println("Service Account Email: " + newMetadata.getServiceAccount().getEmail());
System.out.println("State: " + newMetadata.getState().toString());
System.out.println("Time Created: " + new Date(newMetadata.getCreateTime()).toString());
System.out.println("Time Updated: " + new Date(newMetadata.getUpdateTime()).toString());
System.out.println("ETag: " + newMetadata.getEtag());

Node.js

如需了解详情,请参阅 Cloud Storage Node.js API 参考文档

以下示例会停用 HMAC 密钥:

// Imports the Google Cloud client library
const {Storage} = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// Deactivate HMAC SA Key
async function deactivateHmacKey() {
  /**
   * TODO(developer): Uncomment the following line before running the sample.
   */
  // const hmacKeyAccessId = 'HMAC Access Key Id to update, e.g. GOOG0234230X00';
  // const projectId = 'The project Id this service account belongs to, e.g. serviceAccountProjectId';

  const hmacKey = storage.hmacKey(hmacKeyAccessId, {projectId});
  const [hmacKeyMetadata] = await hmacKey.setMetadata({state: 'INACTIVE'});

  console.log(`The HMAC key is now inactive.`);
  console.log(`The HMAC key metadata is:`);
  for (const [key, value] of Object.entries(hmacKeyMetadata)) {
    console.log(`${key}: ${value}`);
  }
}

以下示例会激活 HMAC 密钥:

// Imports the Google Cloud client library
const {Storage} = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// Activate HMAC SA Key
async function activateHmacKey() {
  /**
   * TODO(developer): Uncomment the following line before running the sample.
   */
  // const hmacKeyAccessId = 'HMAC Access Key Id to update, e.g. GOOG0234230X00';
  // const projectId = 'The project Id this service account belongs to, e.g. serviceAccountProjectId';

  const hmacKey = storage.hmacKey(hmacKeyAccessId, {projectId});
  const [hmacKeyMetadata] = await hmacKey.setMetadata({state: 'ACTIVE'});

  console.log(`The HMAC key is now active.`);
  console.log(`The HMAC key metadata is:`);
  for (const [key, value] of Object.entries(hmacKeyMetadata)) {
    console.log(`${key}: ${value}`);
  }
}

PHP

如需了解详情,请参阅 Cloud Storage PHP API 参考文档

以下示例会停用 HMAC 密钥:

use Google\Cloud\Storage\StorageClient;

/**
 * Deactivate an HMAC key.
 *
 * @param string $accessId Access ID for an inactive HMAC key.
 * @param string $projectId Google Cloud Project ID.
 *
 */
function deactivate_hmac_key($accessId, $projectId)
{
    $storage = new StorageClient();
    // By default hmacKey will use the projectId used by StorageClient().
    $hmacKey = $storage->hmacKey($accessId, $projectId);

    $hmacKey->update('INACTIVE');

    print('The HMAC key is now inactive.' . PHP_EOL);
    printf('HMAC key Metadata: %s' . PHP_EOL, print_r($hmacKey->info(), true));
}

以下示例会激活 HMAC 密钥:

use Google\Cloud\Storage\StorageClient;

/**
 * Activate an HMAC key.
 *
 * @param string $accessId Access ID for an inactive HMAC key.
 * @param string $projectId Google Cloud Project ID.
 *
 */
function activate_hmac_key($accessId, $projectId)
{
    $storage = new StorageClient();
    // By default hmacKey will use the projectId used by StorageClient().
    $hmacKey = $storage->hmacKey($accessId, $projectId);

    $hmacKey->update('ACTIVE');

    print('The HMAC key is now active.' . PHP_EOL);
    printf('HMAC key Metadata: %s' . PHP_EOL, print_r($hmacKey->info(), true));
}

Python

如需了解详情,请参阅 Cloud Storage Python API 参考文档

以下示例会停用 HMAC 密钥:

# project_id = 'Your Google Cloud project ID'
# access_id = 'ID of an active HMAC key'
storage_client = storage.Client(project=project_id)
hmac_key = storage_client.get_hmac_key_metadata(
    access_id,
    project_id=project_id)
hmac_key.state = 'INACTIVE'
hmac_key.update()
print('The HMAC key is now inactive.')
print('The HMAC key metadata is:')
print('Service Account Email: {}'.format(hmac_key.service_account_email))
print('Key ID: {}'.format(hmac_key.id))
print('Access ID: {}'.format(hmac_key.access_id))
print('Project ID: {}'.format(hmac_key.project))
print('State: {}'.format(hmac_key.state))
print('Created At: {}'.format(hmac_key.time_created))
print('Updated At: {}'.format(hmac_key.updated))
print('Etag: {}'.format(hmac_key.etag))

以下示例会激活 HMAC 密钥:

# project_id = 'Your Google Cloud project ID'
# access_id = 'ID of an inactive HMAC key'
storage_client = storage.Client(project=project_id)
hmac_key = storage_client.get_hmac_key_metadata(
    access_id,
    project_id=project_id)
hmac_key.state = 'ACTIVE'
hmac_key.update()
print('The HMAC key metadata is:')
print('Service Account Email: {}'.format(hmac_key.service_account_email))
print('Key ID: {}'.format(hmac_key.id))
print('Access ID: {}'.format(hmac_key.access_id))
print('Project ID: {}'.format(hmac_key.project))
print('State: {}'.format(hmac_key.state))
print('Created At: {}'.format(hmac_key.time_created))
print('Updated At: {}'.format(hmac_key.updated))
print('Etag: {}'.format(hmac_key.etag))

Ruby

如需了解详情,请参阅 Cloud Storage Ruby API 参考文档

以下示例会停用 HMAC 密钥:

# project_id = "Your Google Cloud project ID"
# access_id = "ID of an inactive HMAC key"

require "google/cloud/storage"

storage = Google::Cloud::Storage.new project_id: project_id

# By default Storage#hmac_keys uses the Storage client project_id
hmac_key = storage.hmac_key access_id, project_id: project_id

hmac_key.inactive!

puts "The HMAC key is now inactive."
puts "The HMAC key metadata is:"
puts "Key ID:                #{hmac_key.id}"
puts "Service Account Email: #{hmac_key.service_account_email}"
puts "Access ID:             #{hmac_key.access_id}"
puts "Project ID:            #{hmac_key.project_id}"
puts "Active:                #{hmac_key.active?}"
puts "Created At:            #{hmac_key.created_at}"
puts "Updated At:            #{hmac_key.updated_at}"
puts "Etag:                  #{hmac_key.etag}"

以下示例会激活 HMAC 密钥:

# project_id = "Your Google Cloud project ID"
# access_id = "ID of an inactive HMAC key"

require "google/cloud/storage"

storage = Google::Cloud::Storage.new project_id: project_id

# By default Storage#hmac_keys uses the Storage client project_id
hmac_key = storage.hmac_key access_id, project_id: project_id

hmac_key.active!

puts "The HMAC key is now active."
puts "The HMAC key metadata is:"
puts "Key ID:                #{hmac_key.id}"
puts "Service Account Email: #{hmac_key.service_account_email}"
puts "Access ID:             #{hmac_key.access_id}"
puts "Project ID:            #{hmac_key.project_id}"
puts "Active:                #{hmac_key.active?}"
puts "Created At:            #{hmac_key.created_at}"
puts "Updated At:            #{hmac_key.updated_at}"
puts "Etag:                  #{hmac_key.etag}"

REST API

JSON API

  1. OAuth 2.0 Playground 获取授权访问令牌。将 Playground 配置为使用您自己的 OAuth 凭据。
  2. 创建一个包含以下信息的 .json 文件,并将 [VALUES_IN_BRACKETS] 替换为适当的值:

    {
      "metadata": {
          "state": [STATE]
      }
    }
  3. 使用 cURL,通过 PUT hmacKeys 请求调用 JSON API,注意要将 [VALUES_IN_BRACKETS] 替换为适当的值:

    curl -X PUT --data-binary @[JSON_FILE_NAME].json \
      -H "Authorization: Bearer [OAUTH2_TOKEN]" \
      -H "Content-Type: application/json" \
      "https://www.googleapis.com/storage/v1/projects/[PROJECT_ID]/hmacKeys/[ACCESS_ID]"

XML API

XML API 不能用于更新 HMAC 密钥。请使用其他 Cloud Storage 工具,例如 gsutil。

删除 HMAC 密钥

HMAC 密钥必须处于非活跃状态才能将其删除。 如需删除处于非活跃状态的 HMAC 密钥,请执行以下操作:

控制台

  1. 在 Google Cloud Platform Console 中打开 Cloud Storage 浏览器。
    打开 Cloud Storage 浏览器
  2. 点击设置

  3. 选择互操作标签页。

  4. 点击与您要更新的密钥相关联的铅笔图标

  5. 点击与该密钥的状态关联的更多选项按钮 (“更多操作”图标。)。

  6. 从下拉菜单中选择删除

  7. 在出现的文本框中,输入 HMAC 密钥的访问密钥 ID(与窗口中提供的 ID 相同)。

  8. 点击删除

gsutil

使用 hmac delete 命令,将 [VALUES_IN_BRACKETS] 替换为适当的值:

gsutil hmac delete [KEY_ACCESS_ID]

如果成功,gsutil 不会返回响应。

代码示例

C++

如需了解详情,请参阅 Cloud Storage C++ API 参考文档

namespace gcs = google::cloud::storage;
[](gcs::Client client, std::string access_id) {
  google::cloud::Status status = client.DeleteHmacKey(access_id);

  if (!status.ok()) {
    throw std::runtime_error(status.message());
  }
  std::cout << "The key is deleted, though it may still appear"
            << " in ListHmacKeys() results.\n";
}

C#

如需了解详情,请参阅 Cloud Storage C# API 参考文档

        private void DeleteHmacKey(String accessId)
        {
            var storage = StorageClient.Create();
            storage.DeleteHmacKey(s_projectId, accessId);

            Console.WriteLine($"Key {accessId} was deleted.");
        }

Go

如需了解详情,请参阅 Cloud Storage Go API 参考文档

import (
	"cloud.google.com/go/storage"
	"context"
	"fmt"
	"io"
)

// deleteHMACKey deletes the HMAC key with the given access ID. Key must have state
// INACTIVE in order to succeed.
func deleteHMACKey(w io.Writer, accessID string, projectID string) error {
	ctx := context.Background()

	// Initialize client.
	client, err := storage.NewClient(ctx)
	if err != nil {
		return fmt.Errorf("storage.NewClient: %v", err)
	}
	defer client.Close() // Closing the client safely cleans up background resources.

	handle := client.HMACKeyHandle(projectID, accessID)
	if err = handle.Delete(ctx); err != nil {
		return fmt.Errorf("Delete: %v", err)
	}

	fmt.Fprintln(w, "The key is deleted, though it may still appear in ListHMACKeys results.")

	return nil
}

Java

如需了解详情,请参阅 Cloud Storage Java API 参考文档

// Instantiate a Google Cloud Storage client
Storage storage = StorageOptions.getDefaultInstance().getService();

// The access ID of the HMAC key, e.g. "GOOG0234230X00"
// String accessId = "GOOG0234230X00";
//
// The ID of the project to which the service account belongs.
// String projectId = "project-id";
HmacKeyMetadata metadata =
    storage.getHmacKey(accessId, Storage.GetHmacKeyOption.projectId(projectId));
storage.deleteHmacKey(metadata);

System.out.println(
    "The key is deleted, though it will still appear in getHmacKeys() results given showDeletedKey is true.");

Node.js

如需了解详情,请参阅 Cloud Storage Node.js API 参考文档

// Imports the Google Cloud client library
const {Storage} = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// Delete HMAC SA Key
async function deleteHmacKey() {
  /**
   * TODO(developer): Uncomment the following line before running the sample.
   */
  // const hmacKeyAccessId = 'Inactive HMAC Access Key Id to delete, e.g. GOOG0234230X00';
  // const projectId = 'The project Id this service account belongs to, e.g. serviceAccountProjectId';

  const hmacKey = storage.hmacKey(hmacKeyAccessId, {projectId});
  await hmacKey.delete();

  console.log(
    `The key is deleted, though it may still appear in getHmacKeys() results.`
  );
}

PHP

如需了解详情,请参阅 Cloud Storage PHP API 参考文档

use Google\Cloud\Storage\StorageClient;

/**
 * Delete an HMAC key.
 *
 * @param string $accessId Access ID for an HMAC key.
 * @param string $projectId Google Cloud Project ID.
 *
 */
function delete_hmac_key($accessId, $projectId)
{
    $storage = new StorageClient();
    // By default hmacKey will use the projectId used by StorageClient().
    $hmacKey = $storage->hmacKey($accessId, $projectId);

    $hmacKey->delete();
    print(
      'The key is deleted, though it may still appear in the results of calls ' .
      'to StorageClient.hmacKeys([\'showDeletedKeys\' => true])' . PHP_EOL
    );
}

Python

如需了解详情,请参阅 Cloud Storage Python API 参考文档

# project_id = 'Your Google Cloud project ID'
# access_id = 'ID of an HMAC key (must be in INACTIVE state)'
storage_client = storage.Client(project=project_id)
hmac_key = storage_client.get_hmac_key_metadata(
    access_id,
    project_id=project_id)
hmac_key.delete()
print('The key is deleted, though it may still appear in list_hmac_keys()'
      ' results.')

Ruby

如需了解详情,请参阅 Cloud Storage Ruby API 参考文档

# project_id = "Your Google Cloud project ID"
# access_id = "ID of an inactive HMAC key"

require "google/cloud/storage"

storage = Google::Cloud::Storage.new project_id: project_id

# By default Storage#hmac_keys uses the Storage client project_id
hmac_key = storage.hmac_key access_id, project_id: project_id

hmac_key.delete!

puts "The key is deleted, though it may still appear in Client#hmac_keys results."

REST API

JSON API

  1. OAuth 2.0 Playground 获取授权访问令牌。将 Playground 配置为使用您自己的 OAuth 凭据。
  2. 使用 cURL,通过 DELETE hmacKeys 请求调用 JSON API,注意要将 [VALUES_IN_BRACKETS] 替换为适当的值:

    curl -X DELETE \
      -H "Authorization: Bearer [OAUTH2_TOKEN]" \
      "https://www.googleapis.com/storage/v1/projects/[PROJECT_ID]/hmacKeys/[ACCESS_ID]"

XML API

XML API 不能用于删除 HMAC 密钥。请使用其他 Cloud Storage 工具,例如 gsutil。

后续步骤

此页内容是否有用?请给出您的反馈和评价:

发送以下问题的反馈:

此网页
Cloud Storage
需要帮助?请访问我们的支持页面