fix(secretstores.googlecloud): Handle public GCP service account keys correctly

plugins/secretstores/googlecloud/README.md

@@ -27,6 +27,12 @@ store usage.
   ## Path to the service account credentials file
   credentials_file = "./testdata/gdch.json"
 
+  ## Scopes for the generated access token.
+  ## Only used for standard public-GCP service-account JSON keys ("type": "service_account").
+  ## Defaults to the minimal scope needed for Cloud Monitoring / Stackdriver.
+  ## GDCH/STS users should leave this unset (they rely on sts_audience instead).
+  credential_scopes = ["https://www.googleapis.com/auth/monitoring"]
+
   ## Audience sent to when retrieving an STS token.
   ## Currently only used for GDCH auth flow
   sts_audience = "https://{AUDIENCE_URL}"

plugins/secretstores/googlecloud/googlecloud.go

@@ -28,6 +28,7 @@ func (*GoogleCloud) SampleConfig() string {
 type GoogleCloud struct {
 	STSAudience     string          `toml:"sts_audience"`
 	CredentialsFile string          `toml:"credentials_file"`
+	Scopes          []string        `toml:"credential_scopes"` // used for standard public-GCP service_account keys
 	Log             telegraf.Logger `toml:"-"`
 	common_http.HTTPClientConfig
 
@@ -49,9 +50,17 @@ func (g *GoogleCloud) Init() error {
 	if err != nil {
 		return fmt.Errorf("unable to parse credentials file type: %w", err)
 	}
+
+	// Default minimal scope only for standard public-GCP service-account JSON keys.
+	// GDCH/STS users continue to rely exclusively on sts_audience (Scopes is ignored).
+	if len(g.Scopes) == 0 && credType == "service_account" {
+		g.Scopes = []string{"https://www.googleapis.com/auth/monitoring"}
+	}
+
 	saType := credentials.CredType(credType)
 
 	creds, err := credentials.NewCredentialsFromJSON(saType, serviceAccount, &credentials.DetectOptions{
+		Scopes:      g.Scopes, // new
 		STSAudience: g.STSAudience,
 		Client:      client,
 		Logger:      slog.NewLogger(g.Log),

plugins/secretstores/googlecloud/sample.conf

@@ -8,6 +8,12 @@
   ## Path to the service account credentials file
   credentials_file = "./testdata/gdch.json"
 
+  ## Scopes for the generated access token.
+  ## Only used for standard public-GCP service-account JSON keys ("type": "service_account").
+  ## Defaults to the minimal scope needed for Cloud Monitoring / Stackdriver.
+  ## GDCH/STS users should leave this unset (they rely on sts_audience instead).
+  credential_scopes = ["https://www.googleapis.com/auth/monitoring"]
+
   ## Audience sent to when retrieving an STS token.
   ## Currently only used for GDCH auth flow
   sts_audience = "https://{AUDIENCE_URL}"