Skip to content

fix: update _SERVICE_ACCOUNT_EMAIL_PATTERN to require .gserviceaccount.com suffix #17748

Open
macastelaz wants to merge 1 commit into
mainfrom
fix-service-account-email-pattern
Open

fix: update _SERVICE_ACCOUNT_EMAIL_PATTERN to require .gserviceaccount.com suffix #17748
macastelaz wants to merge 1 commit into
mainfrom
fix-service-account-email-pattern

Conversation

@macastelaz

Copy link
Copy Markdown
Contributor

Addresses issue where some environments provide something that is email-like but is NOT a service account email address when attempting to retrieve the compute SA

@macastelaz
macastelaz requested review from a team as code owners July 16, 2026 20:55

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the service account email validation pattern in the Google Compute Engine metadata module to restrict valid emails to those ending with ".gserviceaccount.com". The corresponding unit tests have been updated to reflect this change, asserting that standard email addresses like "test@example.com" are now considered invalid. There are no review comments, so no additional feedback is provided.

@macastelaz
macastelaz force-pushed the fix-service-account-email-pattern branch 4 times, most recently from ff2b6ba to 2f417f2 Compare July 16, 2026 21:06
@macastelaz macastelaz changed the title Update _SERVICE_ACCOUNT_EMAIL_PATTERN to require .gserviceaccount.com suffix fix: update _SERVICE_ACCOUNT_EMAIL_PATTERN to require .gserviceaccount.com suffix Jul 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

google-auth: Auth incorrectly identifies user emails as service accounts, triggering failing RAB lookups

1 participant