Configuring Authentication for GCP Pub-Sub Push Subscription Using Terraform Google Provider

Question

I am trying to configure GCP Pub Sub Push subscriptions, Total 3 The push subscriptions have been configured successfully, but i am not able to enable Authentication on the push subscription Authentication for Push Subscription is described in this link --> https://cloud.google.com/pubsub/docs/authenticate-push-subscriptions

We are using Terraform to provision resources The module that we are using to configure this is provided in this link -->

GCP Pub Sub Module

We have already given the pub sub agent, "roles/iam.serviceAccountTokenCreator" in the GCP project. The SA that we are using, our caller SA, has been given the "roles/iam.serviceAccountUser

But we don't see anything related to authentication in the speculative terraform plan

The code for enabling OIDC for pub sub push subscription is given here --> OIDC Configuration for Pub Sub Push Subscription

Below is my Terraform Code :

module "app-pubsubpush" {
  source   = "terraform-google-modules/pubsub/google"
  version  = "~> 5.0"
  for_each = { for x, n in var.pubsubpush_config : x => n }

  project_id = var.project_id

 
  topic               = each.value.pubsub_topic_name
  topic_labels        = each.value.pubsub_topic_labels
  subscription_labels = each.value.subscription_labels

 
  push_subscriptions = [
    {

      name = each.value.pubsub_subscription_name
      push_endpoint              = each.value.pubsub_subscription_endpoint
      oidc_token                 = each.value.oidc_token
      message_retention_duration = "604800s" // Default (7 days)
      retain_acked_messages      = false     // Default
      ack_deadline_seconds       = 10        // Default
      expiration_policy          = ""        // Subscription never expires
      max_delivery_attempts = 5      // Default
      minimum_backoff       = "10s"  // Default
      maximum_backoff       = "600s" // Default

      enable_message_ordering      = true
      enable_exactly_once_delivery = true

      service_account = var.pubsub_subscription_sa
    }
  ]

  depends_on = [
    module.pubsub_dl
  ]
}

npd.tfvar :

pubsub_config = [
  {
    pubsub_topic_name = "app_notifications"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0011392" # ArcSight-NPD-001
      cm_service_offering_num    = "bsn0010403"   # Security Monitoring & Alerting - ArcSight-NPD
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0011392" # ArcSight-NPD-001
      cm_service_offering_num    = "bsn0010403"   # Security Monitoring & Alerting - ArcSight-NPD
    }
    pubsub_subscription_name     = "app_notifications_arcsight"
    pubsub_subscription_dl_topic = "app_notifications_arcsight_dl"
  }
]



#===========Pubsub Subscription Service Account===========#

pubsub_subscription_sa = "[email protected]"
pubsub_push_subscription_sa = "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com"


pubsubpush_config = [
    {
    pubsub_topic_name = "app_notifications_secops"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    pubsub_subscription_endpoint = "https://us-chronicle.googleapis.com/v1alpha/projects/xxxxxx/locations/us/instances/xxxxxx/feeds/xxxxxxxxx:importPushLogs"
    oidc_token                   =  "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com"
    pubsub_subscription_name     = "app_notifications_secops_push"
 #   pubsub_subscription_dl_topic = "app_notifications_secops_dl"
  },
    {
    pubsub_topic_name = "appengine_notifications_secops"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    pubsub_subscription_endpoint = "https://us-chronicle.googleapis.com/v1alpha/projects/xxxxxxx/locations/us/instances/xxxxxxxxx/feeds/xxxxxx-xxxxxx:importPushLogs"
    oidc_token                   = "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com",
    pubsub_subscription_name     = "appengine_notifications_secops_push"
  
  },
    {
    pubsub_topic_name = "dataaccess_notifications_secops"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    pubsub_subscription_endpoint = "https://us-chronicle.xxxxx/v1alpha/projects/xxxxxxx/locations/us/instances/xxxxxxxxxx/feeds/6ef5f8d4-8199-4cb7-8cb6-43d5331a0182:importPushLogs"
    oidc_token                   =  "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com"
    pubsub_subscription_name     = "dataaccess_notifications_secops_push"
   
  }
]

Where does oidc_token come from? The pubsub module only has oidc_service_account_email afaict registry.terraform.io/modules/terraform-google-modules/pubsub/… — somethingsomething
– somethingsomething, Commented Sep 20, 2024 at 14:33
Yes, i used oid_service_account_email now and that worked. But now i am getting this error : Error: Error updating Subscription "projects/cnr-scc-npd-kaw8/subscriptions/app_notifications_secops_push": googleapi: Error 403: User not authorized to perform this action. with module.app-pubsubpush["0"].google_pubsub_subscription.push_subscriptions["app_notifications_secops_push"] on .terraform/modules/app-pubsubpush/main.tf line 131, in resource "google_pubsub_subscription" "push_subscriptions": resource "google_pubsub_subscription" "push_subscriptions" { — Pallab
– Pallab, Commented Sep 20, 2024 at 14:43
What is the role that is required to be assigned to the SA that is enabling oidc, i have given roles/pubsub.editor, that is not working — Pallab
– Pallab, Commented Sep 20, 2024 at 14:44

PMorganCA · Accepted Answer · 2025-05-13 16:17:45Z

I was seeing a similar 403 error, when running terraform to create a google_pubsub_subscription with

 push_config {
    <snip> 
    idc_token {
        service_account_email = "test-sa@my_gcp.iam.gserviceaccount.com"
        <snip>

The terraform was being called from a GitHub workflow that authenticated using a workload identity provider for this service account terraform-sa@my_gcp.iam.gserviceaccount.com

When I assigned roles/iam.serviceAccountUser to terraform-sa@my_gcp.iam.gserviceaccount.com, the push subscription was created and was tested successfully. (and hey! serviceAccountAdmin does not contain the permission for iam.serviceAccounts.actAs , which you need. serviceAccountUser does.

Note that I also assigned roles/iam.serviceAccountTokenCreator to test-sa@google_pubsub_subscription because that seemed to be what this doc was telling me: https://cloud.google.com/pubsub/docs/subscription-properties#prereqs-auth

-----

Additional note: If the idc_token uses service_account_email = "", then the push subscription is created with Push authentication: Disabled, which turned out to be handy for me creating subscriptions for a list of end-points, because I was using a list and a for_each loop.

Collectives™ on Stack Overflow

Configuring Authentication for GCP Pub-Sub Push Subscription Using Terraform Google Provider

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related