How to use Service Accounts with gsutil, for downloading from CS - DCM Google private owned bucket

Question

A project, a Google Group have been set up for controlling data access following the DCM guide: https://support.google.com/dcm/partner/answer/3370481?hl=en-GB&ref_topic=6107456

The project does not contain the bucket I want to access(under Storage->Cloud Storage), since it's Google owned bucket, for which I only have read only access. I can see the bucket in my browser since I am allowed to with my Google account(since I am a member of the ACL).

I used the gsutil tool to configure the service account of the project that was linked with the private bucket using

gsutil config -e

but when I try to access that private bucket with

gsutil ls gs://<bucket_name>

I always get 403 errors, and I don't know why is that. Did anyone tried that before or any ideas are welcome.

Answer 1

Since the bucket is private and in project A, service accounts in your project (project B) will not have access. The service account for your project (project B) would need to be added to the ACL for that bucket.

Note that since you can access this bucket with read access as a user, you can run gsutil config to grant your user credentials to gsutil and use that to read the bucket.