From dc17146574b5768510526b5d39b520277d5a2b9e Mon Sep 17 00:00:00 2001 From: AKASHDEEP KAUR Date: Mon, 5 Oct 2026 09:47:46 +0000 Subject: [PATCH] Add audit log for non-service_account GCP credential types Emit a WARN audit log in GCPUtils.loadServiceAccountCredentials whenever the credentials supplied via the service account file path / JSON are not of type 'service_account' (e.g. external_account, authorized_user), so that any such usage can be identified. No behaviour change. --- src/main/java/io/cdap/plugin/gcp/common/GCPUtils.java | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/main/java/io/cdap/plugin/gcp/common/GCPUtils.java b/src/main/java/io/cdap/plugin/gcp/common/GCPUtils.java index 4ebae9bb00..c28ff5af04 100644 --- a/src/main/java/io/cdap/plugin/gcp/common/GCPUtils.java +++ b/src/main/java/io/cdap/plugin/gcp/common/GCPUtils.java @@ -118,7 +118,14 @@ public static GoogleCredentials loadServiceAccountCredentials(String serviceAcco boolean isServiceAccountFilePath) throws IOException { try (InputStream inputStream = openServiceAccount(serviceAccount, isServiceAccountFilePath)) { - return GoogleCredentials.fromStream(inputStream); + GoogleCredentials credentials = GoogleCredentials.fromStream(inputStream); + if (!(credentials instanceof ServiceAccountCredentials)) { + // Audit log: record usage of credential types other than 'service_account' supplied via the + // service account file path / JSON, so that such usage can be identified. + LOG.warn("Audit: loaded GCP credentials of type '{}' from the service account {}.", + credentials.getClass().getSimpleName(), isServiceAccountFilePath ? "file path" : "JSON"); + } + return credentials; } }