Google Cloud Pubsub authentication error from App Engine

3
votes

We're having trouble publishing messages to a Google Cloud PubSub topic on Google AppEngine. Using the Application Default credentials works perfect locally. But once it's deployed on Google AppEngine it gives the following error: 

<HttpError 403 when requesting https://pubsub.googleapis.com/v1/projects/our-project-id/topics/our-topic:publish?alt=json returned "The request cannot be identified with a project. Please pass a valid API key with the request.">

I would assume that it's will use the service account of app engine to access the PubSub API. Here is the code we used to create the credentials.

credentials = GoogleCredentials.get_application_default()
if credentials.create_scoped_required():
   credentials = credentials.create_scoped(['https://www.googleapis.com/auth/pubsub'])

http = httplib2.Http()
credentials.authorize(http)
pubsub_service = build('pubsub', 'v1', http=http)

The error is thrown when publishing the actual message to PubSub.

pubsub_service.projects().topics().publish(topic="projects/out-project-id/topics/out-topic", body = { 'messages' : [ { 'data': base64.b64encode(request.get_data()) }]}).execute()

Not that the same flow works doing API call's to "BigQuery", so it's not a general Google API problem. It seems to be specific to PubSub...

1
google-app-enginegoogle-cloud-platformgoogle-cloud-pubsub
Is the project where the target topic exists the same as the project you deployed the app? - Takashi Matsuo
yes it is, we only have one cloud project. We even tried to explicitly give the "appspot" service account Editor right on the topic. - alexvanboxel
Is it possible for you to invite me (tmatsuo@google.com) as an editor to investigate? - Takashi Matsuo
I've mailed you direct. - alexvanboxel
Ok, seems like your service account is not associated with any project ids, which seems like a problem on our side. Let me investigate more and I will let you know. - Takashi Matsuo

1 Answers

2
votes

It's a rare case of the service account without project id embedded in it. We fixed your service account and you should be good to go now. Sorry for the trouble.