6

I am trying to get a service account to create blobs in Google Cloud Storage from within a Python script, but I am having issues with the credentials.

1) I create the service account for my project and then download the key file in json:

"home/user/.config/gcloud/service_admin.json"

2) I give the service account the necessary credentials (via gcloud in a subprocess)

 roles/viewer, roles/storage.admin,  roles/resourcemanager.projectCreator, roles/billing.user

Then I would like to access a bucket in GCS

from google.cloud import storage
import google.auth

credentials, project = google.auth.default()
client = storage.Client('myproject', credentials=credentials)
bucket = client.get_bucket('my_bucket')

Unfortunately, this results in: 

google.api_core.exceptions.Forbidden: 403 GET
https://www.googleapis.com/storage/v1/b/my_bucket?projection=noAcl:
s_account@myproject.iam.gserviceaccount.com does not have
storage.buckets.get access to my_bucket

I have somewhat better luck if I set the environment variable 

export GOOGLE_APPLICATION_CREDENTIALS="home/user/.config/gcloud/service_admin.json"

and rerun the script. However, I want it all to run in one single instance of the script that creates the accounts and continues to create the necessary files in the buckets. How can I access my_bucket if I know where my json credential file is.

TasosZG
  • 1,274
  • 1
  • 6
  • 13
Mike
  • 3,775
  • 8
  • 39
  • 79

1 Answers1

7

Try this example from the Documentation for Server to Server Authentication:

from google.cloud import storage

# Explicitly use service account credentials by specifying the private key file.
storage_client = storage.Client.from_service_account_json('service_account.json')

# Make an authenticated API request
buckets = list(storage_client.list_buckets())
print(buckets)

This way you point the file containing the key of the Service Account directly in your code.

TasosZG
  • 1,274
  • 1
  • 6
  • 13
  • This works! Actually my error was that I was referring to a bucket [client.lookup_bucket('my_bucket') that was created in previous project and now deleted; hence the permissioning issue]. – Mike Mar 04 '19 at 14:45