Skip to main content
Solved

Google Cloud Storage - Service Account Configuration on FME server

kartemann

Hello FME friends,

I have a question about system path variables and how that translates to FME server.

I downloaded the Google cloud Storage connector from FME HUB. I'm using a Google service account along with a service account, JSON key file. Part of the configuration is to set the windows environment variable GOOGLE_APPLICATION_CREDENTIALS to a JSON key file I downloaded from Google Cloud Console.

The package works flawlessly in FME workbench on my workstation. I would like to now publish a workflow to FME server, but am scratching my head trying to figure out how to deal with the environment variable GOOGLE_APPLICATION_CREDENTIALS and how that translates to FME server.

I assume the .JSON key file for this Google service account needs to be on FME server somewhere, but how do I tell FME server that the environment variable points to the .JSON file on an FME server resource folder?

 

Thank you!

Best answer by gerhardatsafe

Hi @kartemann,

While the option to put your key file into the Shared Resources of FME Server is a possible solution, I still want to add a few recommendations to this regarding security and best practices:

The recommended way to share credentials between FME Desktop & FME Server is through Web Connections. You can set up a Web Connection for the GoogleCloudStorageConnector with a Google account that has the permissions that you prefer. When you publish the workspace the Web Connection will be automatically published with the workspace unless the Web Connection already exists (but can also overwrite). You can also reauthenticate the Web Connection on FME Server if needed. Another major benefit is that the credentials in the Web Connection are encrypted therefore less at risk to be stolen, while a key file in the Shared Resources can actually be read & removed by anybody who is able to run a workspace on the FME Server.

So if you must use the key file and the environment variable and you have access to the system to set environment variables I would highly recommend storing the file in a secure place without full Read/Write access by all FME Server users.

If there is a specific reason why you need to use the key file on FME Desktop & FME Server, or why a Web Connection is not an option in your scenario please let us know. We are always looking to improve and very to get feedback and specific use case.

View original
Did this help you find an answer to your question?

4 replies

itay
Supporter
Forum|alt.badge.img+16
  • itaySupporter
  • Supporter
  • July 22, 2019

Hi @kartemann,

Maybe this article might help (see section 4a) another issue to consider is managing your web connections on FME Server.

Hope this helps,

Itay

nathanatsafe
Safer
Forum|alt.badge.img+7

Hi @kartemann,

 

Thanks for the question. Depending on your FME Server architecture and your administrative capabilities this may be easier or harder to set up. But the principle that worked for me on Windows was to place the JSON key file in the FME Server System Share, and set a system environment variable pointing to that path on disk. I did this through the control panel settings dialog rather than via the command line. For my default express install the path I used was "C:\\ProgramData\\Safe Software\\FME Server\\resources\\system\\<keyfile>". So far this is working for me. Will this suit your environment?

 

 

Best,

 

Nathan
kartemann
  • kartemann
  • Author
  • July 29, 2019
nathanatsafe wrote:

Hi @kartemann,

 

Thanks for the question. Depending on your FME Server architecture and your administrative capabilities this may be easier or harder to set up. But the principle that worked for me on Windows was to place the JSON key file in the FME Server System Share, and set a system environment variable pointing to that path on disk. I did this through the control panel settings dialog rather than via the command line. For my default express install the path I used was "C:\\ProgramData\\Safe Software\\FME Server\\resources\\system\\<keyfile>". So far this is working for me. Will this suit your environment?

 

 

Best,

 

Nathan

That did the trick, Thank you very much!

G
Forum|alt.badge.img

Hi @kartemann,

While the option to put your key file into the Shared Resources of FME Server is a possible solution, I still want to add a few recommendations to this regarding security and best practices:

The recommended way to share credentials between FME Desktop & FME Server is through Web Connections. You can set up a Web Connection for the GoogleCloudStorageConnector with a Google account that has the permissions that you prefer. When you publish the workspace the Web Connection will be automatically published with the workspace unless the Web Connection already exists (but can also overwrite). You can also reauthenticate the Web Connection on FME Server if needed. Another major benefit is that the credentials in the Web Connection are encrypted therefore less at risk to be stolen, while a key file in the Shared Resources can actually be read & removed by anybody who is able to run a workspace on the FME Server.

So if you must use the key file and the environment variable and you have access to the system to set environment variables I would highly recommend storing the file in a secure place without full Read/Write access by all FME Server users.

If there is a specific reason why you need to use the key file on FME Desktop & FME Server, or why a Web Connection is not an option in your scenario please let us know. We are always looking to improve and very to get feedback and specific use case.

Reply


Helpful Members This Week

Community Stats

30,940
Posts
117,251
Replies
38,742
Members

Latest FME

Terms & ConditionsCookie settings

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings
A product of
Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.