Google Cloud API: Forbidden to access Enabled API using Service Account key

Question

I am having issues use Service Account P12 Key and getting HttpError 403.

However, I do not have this issue if I use Web OAuth using Client ID and Secret. However, I am creating as Service to Service application.

Google Cloud API JSON is enabled.

import os
from httplib2 import Http
from pprintpp import pprint

from oauth2client.client import SignedJwtAssertionCredentials
from apiclient.discovery import build
from googleapiclient.errors import HttpError

SITE_ROOT = \
    os.path.dirname(os.path.realpath(__file__))
P12_FILE = \
    "REDACTED-0123456789.p12"

P12_PATH = os.path.join(SITE_ROOT, P12_FILE)
pprint(P12_PATH)

SCOPE = \
    'https://www.googleapis.com/auth/devstorage.read_only'
PROJECT_NAME = \
    'mobileapptracking-insights'
BUCKET_NAME = \
    'pubsite_prod_rev_0123456789'
CLIENT_EMAIL = \
    '[email protected]'

private_key = None
with open(P12_PATH, "rb") as p12_fp:
  private_key = p12_fp.read()

credentials = SignedJwtAssertionCredentials(
    CLIENT_EMAIL,
    private_key,
    SCOPE)

http_auth = credentials.authorize(Http())

storage = build('storage', version='v1', http=http_auth)

request = storage.objects().list(bucket=BUCKET_NAME)

try:
    response = request.execute()
except HttpError as error:
    print("HttpError: %s" % str(error))
    raise
except Exception as error:
    print("%s: %s" % (error.__class__.__name__, str(error)))
    raise

print(response)

Error message:

HttpError: <HttpError 403 when requesting https://www.googleapis.com/storage/v1/b/pubsite_prod_rev_0123456789/o?alt=json returned "Forbidden">

What do I need to do to resolve this issue?

jerjou jerjou · Accepted Answer · 2016-01-29T20:47:19

Your code looks fine (I just pasted it, changed the appropriate constants, and successfully ran it).

I would double-check:

That your client email is the correct one for the p12 key
That the bucket you're listing is accessible to that service account

Some other things you could do to help you figure out where the problem is:

Verify that you can list the public uspto-pair bucket
import httplib2 and set httplib2.debuglevel = 1, and verify that the requests that are being made are the expected ones.

Google Cloud API: Forbidden to access Enabled API using Service Account key

2 Answers