Access Google Secret Manager API using curl

google-secret-manager.sh

#!/usr/bin/env bash
# Test script to access/generate secrets in Secret Manager

PROJECT="engineering-devops"
SCOPE="https://www.googleapis.com/auth/cloud-platform"
SERVICE_ACCOUNT_FILE=secret-manager.json
SECRET=my-secret

# Reference: https://gist.github.com/ryu1kn/c76aed0af8728f659730d9c26c9ee0ed

base64var() {
  printf "$1" | base64stream
}

base64stream() {
  base64 | tr '/+' '_-' | tr -d '=\n'
}

# Given a service account json file path, and a scope, create an jwt token
create_jwt_token() {
  key_json_file="$1"
  scope="$2"
  valid_for_sec="${3:-3600}"
  private_key=$(jq -r .private_key $key_json_file)
  sa_email=$(jq -r .client_email $key_json_file)

  header='{"alg":"RS256","typ":"JWT"}'
  claim=$(
    cat <<EOF | jq -c
    {
      "iss": "$sa_email",
      "scope": "$scope",
      "aud": "https://www.googleapis.com/oauth2/v4/token",
      "exp": $(($(date +%s) + $valid_for_sec)),
      "iat": $(date +%s)
    }
EOF
  )
  request_body="$(base64var "$header").$(base64var "$claim")"
  signature=$(openssl dgst -sha256 -sign <(echo "$private_key") <(printf "$request_body") | base64stream)
  echo "$request_body.$signature"
}

# Given an json service acccount file and a scope, fetch an access token.
get_access_token() {
  key_json_file="$1"
  scope="$2"

  jwt_token=$(create_jwt_token "$key_json_file" "$scope")

  payload=$(curl -s -X POST https://www.googleapis.com/oauth2/v4/token \
    --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer' \
    --data-urlencode "assertion=$jwt_token")

    echo $payload | jq -r .access_token
}

token=$(get_access_token $SERVICE_ACCOUNT_FILE $SCOPE)

# Test fetching a secret. Use the latest version

curl "https://secretmanager.googleapis.com/v1/projects/$PROJECT/secrets/$SECRET/versions/latest:access" \
  --request "GET" \
  --header "authorization: Bearer $token" \
  --header "content-type: application/json" \
  --header "x-goog-user-project: $PROJECT"

# Test writing a new secret

SECRET_DATA=$(echo "seCr3t" | base64)


curl "https://secretmanager.googleapis.com/v1/projects/$PROJECT/secrets/$SECRET:addVersion" \
  --request "POST" \
  --header "authorization: Bearer $token" \
  --header "content-type: application/json" \
  --header "x-goog-user-project: $PROJECT" \
  --data "{\"payload\": {\"data\": \"${SECRET_DATA}\"}}"

the jq -c on line 29 was giving me a usage message.
See
jq issue 1110
https://github.com/stedolan/jq/issues/1110

See comment wtlangford on 9 Sep 2016 for the fix I used.