Gsutil: Is there a way to use service account impersonation with gsutil?

[bboe]

I'm digging into solidifying our IAM policies and recently learned that service accounts could be impersonated. This appears to be working great with gcloud via the --impersonate-service-account=[e-mail], however, I have yet to figure out how to use gsutil with such impersonation.

From an API point of view, it appears that obtaining a short-lived impersonation access token is needed, and then that token is needed for requests. Even if I could obtain such a token out-of-band, it doesn't seem like it could be used with gsutil as is. Am I correct about that?

Assuming there isn't already a way to accomplish this task, is such a feature likely to be added? Thanks!

[m1racoli]

Yes, we use a composer service account to execute docker images in Kubernetes, but we'd like to operate on buckets using gsutil using a dedicated service account in those docker images. Don't understand why --impersonate-service-account isn't supported.

[thomasmaclean]

I'm happy to report support for service account impersonation was added with v4.44.

[bboe]

Fantastic! Thank you.