What I'm trying to do is to:

1. Create a service account
2. Give that service account Domain Wide Delegations
3. Use the Application Default Credentials to impersonate a Google Workspace user and access it's email with gmail API

My code works fine in local development, by using the credential key json file generated for the Service Account mentioned in step 1, through Application Credentials Default mechanism (I have set up the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the credentials.json)

import {google} from 'googleapis'

const scopes = [
  'https://www.googleapis.com/auth/gmail.readonly',
  'https://www.googleapis.com/auth/gmail.modify',
];

const auth = new google.auth.GoogleAuth({
    clientOptions: {
      subject: 'user@email.com',
    },
    scopes,
});

const gmail = google.gmail({
    version: 'v1',
    auth,
});

const list = await gmail.users.messages.list({
    userId: 'me',
    maxResults: 10,
});

The problem is AFAIK, in local environment (aka not GCE) GoogleAuth uses JWT and in GCE it uses Compute Auth method, where a subject can't be configured or if configured is ignored.

So that's why when deploying the Cloud Function it throws an error about Precondition Check Failed and nothing else more specific.

In my limited knowledge and research I think the solution would be to somehow convert the Compute Auth -> JWT with a subject defined.

The current solution I have implemented and works, consists in saving the credentials.json into the Google Secret Manager:

  // Acquire credentials from secret manager:
  const secret = await getApiKeyFromSecretManager('SECRET_NAME');
  const jsonCreds = JSON.parse(Buffer.from(secret).toString());

  // Create the JWT
  const auth = google.auth.fromJSON(jsonCreds);
  auth.subject = 'user@email.com';
  auth.scopes = scopes;

But I'm not really comfortable having to access or save the credentials in the Secret Manager, as I think the solution is not as elegant as it could be.