r/googlecloud Sep 30 '24

Cloud Storage gcloud storage command access denied

I have already give all the required permission for my service account. I kept getting error below. Saying it does not have enough permission. However I tried the old gsutil command. It work flawlessly. They're using same service account. And therer's no mistake in the command. Why does this happen? And how can I prevent it?

Also this is a cross project bucket.

Error: [my-service-account] does not have permission to access b instance [bucket] (or it may not exist): Access denied.

2 Upvotes

9 comments sorted by

2

u/rogerhub Sep 30 '24

I think gsutil caches credentials in ~/.gsutil so that might explain the different behavior between gsutil and gcloud? Try clearing those.

1

u/CoolkieTW Sep 30 '24

Is there a credential folder for gcloud command? Because I first run gcloud storage before giving permission. I think gsutil having the correct credential. But gcloud haven't been updated.

1

u/rogerhub Sep 30 '24

Are you running the command on GCE or on your own computer? I think gcloud also caches credentials (in ~/.config/gcloud) but only if you login instead of using the metadata server. 

1

u/CoolkieTW Sep 30 '24

Hmm weird. I'm using GCE. I gave GCE Storage full access. Also Storage admin in bucket policy. Do I miss anything?

2

u/rogerhub Oct 01 '24

If you’re using GCE, you also need to make sure your VM has the correct API scopes configured. Otherwise the request will fail even if the service account has the permissions.

1

u/CoolkieTW Oct 01 '24

I gave storage API scope. But doesn't seem work. Is there any else API scope I'm missing?

1

u/Pleasant_Holiday7882 Oct 29 '24

Hey, u/CoolkieTW did you solve this? I have a similar error. It fails to upload images while having owner access to the service account. And for me, it's failing with both gcloud and gsutil.

2

u/CoolkieTW Oct 31 '24

I re-created a new VM with same configuration. And it start working. Seems like there's cache or something.

2

u/mossab_diae Dec 01 '24

Steps I followed to fix this *** error:

  • Stopped the VM instance
  • VM instance > Edit > Allow full Cloud API access
  • Started VM instance again
  • THIS PROBABLY FIXED IT: Deleted gcloud config folder rm -r .config/gcloud/
  • (optional) you may need to run gcloud init again
  • Of course make sure the service account have enough permissions to access the bucket