<p dir="auto"><strong>Description</strong></p>
<p dir="auto">Allow a a Google API credentials object to be provided for GoogleBaseHook. I think this would be as  simple as updating the initializer to set <code class="notranslate">self._cached_credentials</code> to a passed-in arg here:<br>
</p><div class="Box Box--condensed my-2">
  <div class="Box-header f6">
    <p class="mb-0 text-bold">
      <a href="https://github.com/apache/airflow/blob/daed75260903119f8f5dc8ee493778c50b1a6a8f/airflow/providers/google/common/hooks/base_google.py#L156">airflow/airflow/providers/google/common/hooks/base_google.py</a>
    </p>
    <p class="mb-0 color-fg-muted">
         Line 156
      in
      <a data-pjax="true" class="commit-tease-sha" href="/apache/airflow/commit/daed75260903119f8f5dc8ee493778c50b1a6a8f">daed752</a>
    </p>
  </div>
  <div itemprop="text" class="Box-body p-0 blob-wrapper blob-wrapper-embedded data">
    <table class="highlight tab-size mb-0 js-file-line-container" data-tab-size="8" data-paste-markdown-skip="">

        <tbody><tr class="border-0">
          <td id="L156" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="156"></td>
          <td id="LC156" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-k">def</span> <span class="pl-en">__init__</span>(<span class="pl-s1">self</span>, <span class="pl-s1">gcp_conn_id</span>: <span class="pl-s1">str</span> <span class="pl-c1">=</span> <span class="pl-s">'google_cloud_default'</span>, <span class="pl-s1">delegate_to</span>: <span class="pl-v">Optional</span>[<span class="pl-s1">str</span>] <span class="pl-c1">=</span> <span class="pl-c1">None</span>) <span class="pl-c1">-&gt;</span> <span class="pl-c1">None</span>: </td>
        </tr>
    </tbody></table>
  </div>
</div>
<p></p>
<p dir="auto"><strong>Use case / motivation</strong></p>
<p dir="auto">This should allow a service accounnt running Airflow to <a href="https://google-auth.readthedocs.io/en/latest/reference/google.auth.impersonated_credentials.html" rel="nofollow">impersonate another service account</a>, without needing to deal with exported service account keys as the connection ID paradigm seems to require.</p>
<p dir="auto">Does this change make sense given the Airflow architecture?</p>
<p dir="auto"><strong>Description</strong><br>
Allow running Google Cloud operators using Service Accounts, without having to provide key material while running on GCP. If the Compute instance Service Accounts on which Airflow is running have been granted "Service Account Token Creator" role on the target Service Account with which I want to run my operator, I do not need to download, or provide any key material for the impersonation to happen. This is a much more secure way to impersonate service accounts.</p>
<p dir="auto"><strong>Use case / motivation</strong></p>
<p dir="auto">Allow running Google Cloud operators using Service Accounts, without having to provide key material while running on GCP. If the Compute instance Service Accounts on which Airflow is running have been granted "Service Account Token Creator" role on the target Service Account with which I want to run my operator, I do not need to download, or provide any key material for the impersonation to happen. This is a much more secure way to impersonate service accounts.</p>
<p dir="auto"><a href="https://github.com/googleapis/google-auth-library-python/blob/master/docs/user-guide.rst#impersonated-credentials">https://github.com/googleapis/google-auth-library-python/blob/master/docs/user-guide.rst#impersonated-credentials</a></p>
<p dir="auto"><strong>Related Issues</strong></p>
<p dir="auto">None</p>