feat(storage): find GoogleAccessID when using impersonated creds

[BrennaEpp]

bucket.SignedURL and bucket.GenerateSignedPostPolicyV4 now automatically detect the GoogleAccessID when using impersonated credentials, i.e. when authenticated via gcloud auth application-default login --impersonate-service-account ${SERVICE_ACCOUNT}

This prevents users from having to manage a private key or pass in the service account to these methods in their code; see #5979

[tritone]

Generally looks good, a few comments on docs clarity and factoring. We should also update the docs for SignedURL and PostPolicyV4 options; they still note that "at least one of PrivateKey and SignedBytes must be non-nil" which is not accurate.

[tritone]

Couple more docs nits, but overall looks good

[jawher]

FWIW:

I was impacted by this issue, and as a workaround, I currently have to do the following:

• parse the Google Service Account JSON to extract the 2 fields client_email and private_key
• passe these 2 fields to calls to SignedURL

serviceAccount = json.Unmarshal(os.Getenv("GOOGLE_CREDENTIALS"))

res, err := client.Bucket(bucket).SignedURL(path, &gstorage.SignedURLOptions{
	Scheme: gstorage.SigningSchemeV4,
	Method: "PUT",
	GoogleAccessID: serviceAccount.ClientEmail,
	PrivateKey:     []byte(serviceAccount.PrivateKey),
	Expires: time.Now().Add(15 * time.Minute),
})

I just tested using this PR, by adding the following in go.mod:

replace cloud.google.com/go => github.com/BrennaEpp/google-cloud-go sign

And changing my code to:

• no longer parse the service account json
• nor pass the client_email and private_key fields to SignURL

And I'm glad to report that this works as before 👍 🥳 🍻

Thank you @BrennaEpp and can't wait for this to get merged and released 🤞

[tritone]

Thanks Brenna!