[google-cloud-sql-discuss] Re: A bit scary. Was able to connect to my instance using google cloud sql proxy after deleting my service role account

Hey wobeng@,

This is expected behaviour. The Service Account's credentials are used to get an access token via OAuth2. If that token isn't revoked, it will continue to work for the default 3600 seconds. I hope this helps clear up the behaviour you saw!

Cheers,

Nick
Cloud Platform Community Support

On Thursday, March 31, 2016 at 1:55:15 PM UTC-4, wobeng@yblew.com wrote:

after an hour, now i'm getting

Post https://www.googleapis.com/sql/v1beta4/projects/hidden/instances/hidden/createEphemeral?alt=json: oauth2: cannot fetch token: 401 Unauthorized

Response: {

  "error" : "invalid_client",

  "error_description" : "The OAuth client was not found."

}

Does it take a while for google cloud sql proxy to sync up with changes to permissions?

On Thursday, March 31, 2016 at 12:49:47 PM UTC-4, wob...@yblew.com wrote:

A bit scary. Was able to connect to my instance using google cloud sql proxy after deleting my service role account

1. Created a service account under editor role

2. Was able to access my server using:

/usr/local/bin/cloud_sql_proxy -dir=/cloudsql -instances=my-project:us-central1:sql-instance=tcp:3306 -credential_file=/prod.json &

3. Deleted my service account

4. Was able to access my instance after deletion of service account using:

/usr/local/bin/cloud_sql_proxy -dir=/cloudsql -instances=my-project:us-central1:sql-instance=tcp:3306 -credential_file=/prod.json &

--
You received this message because you are subscribed to the Google Groups "Google Cloud SQL discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-cloud-sql-discuss+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-cloud-sql-discuss/e63cb7bc-d1e5-4b4f-817e-e22970da7395%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.