Filebeat Google Cloud Storage Input requires JSON or file credentials for authentication which causes issues when using workload identity about beats

[bkaznowski]

Yes, I believe this sounds right. We use the gcp-pubsub input too and we haven't had any issues with using it alongside workload identity. It would also be a nice solution to bring both of these under the same behaviour

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[andrewkroh]

I think the same logic used by the GCP Pub/Sub input could be implemented by the GCS input. If none of the config options are set then it checks if it can load application default credentials before failing.

beats/x-pack/filebeat/input/gcppubsub/config.go

Lines 45 to 68 in d2c4c2d

	func (c *config) Validate() error {
	// credentials_file
	if c.CredentialsFile != "" {
	if _, err := os.Stat(c.CredentialsFile); os.IsNotExist(err) {
	return fmt.Errorf("credentials_file is configured, but the file %q cannot be found", c.CredentialsFile)
	} else {
	return nil
	}
	}
	// credentials_json
	if len(c.CredentialsJSON) > 0 {
	return nil
	}
	// Application Default Credentials (ADC)
	ctx := context.Background()
	if _, err := google.FindDefaultCredentials(ctx, pubsub.ScopePubSub); err == nil {
	return nil
	}
	return fmt.Errorf("no authentication credentials were configured or detected " +
	"(credentials_file, credentials_json, and application default credentials (ADC))")
	}

Does that sound correct to you @bkaznowski?