Upstream GCP Self-Signed JWT Policy

This policy adds a JWT token to the headers, ready for us in an outgoing request when calling a GCP service (e.g. Cloud Endpoints / ESPv2). We recommend reading the serviceAccountJson from environment variables (so it is not checked in to source control) using the $env(ENV_VAR) syntax.

CAUTION: This policy only works with certain Google APIs. In most cases, the Upstream GCP Service Auth should be used.

Configuration

The configuration shows how to configure the policy in the 'policies.json' document.

config/policies.json
{
  "name": "my-upstream-gcp-jwt-inbound-policy",
  "policyType": "upstream-gcp-jwt-inbound",
  "handler": {
    "export": "UpstreamGcpJwtInboundPolicy",
    "module": "$import(@zuplo/runtime)",
    "options": {
      "audience": "your_gcp_service.endpoint.com",
      "serviceAccountJson": "$env(SERVICE_ACCOUNT_JSON)"
    }
  }
}

Policy Configuration

• name <string> - The name of your policy instance. This is used as a reference in your routes.
• policyType <string> - The identifier of the policy. This is used by the Zuplo UI. Value should be upstream-gcp-jwt-inbound.
• handler.export <string> - The name of the exported type. Value should be UpstreamGcpJwtInboundPolicy.
• handler.module <string> - The module containing the policy. Value should be $import(@zuplo/runtime).
• handler.options <object> - The options for this policy. See Policy Options below.

Policy Options

The options for this policy are specified below. All properties are optional unless specifically marked as required.

• audience (required) <string> - The audience for the minted JWT. See the document AuthRequirement for details.
• serviceAccountJson (required) <string> - The Google Service Account key in JSON format. Note you can load this from environment variables using the $env(ENV_VAR) syntax.

Using the Policy

Read more about how policies work