Google Cloud ML Engine: Unable to access Cloud KMS

Question

I have a encrypted text, encrypted using Cloud KMS, and I need to decrypt it from the context of a code running in Cloud ML Engine. However I'm running into the following error:

    shaded.com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 Forbidden 
    { 
      "code" : 403,
      "errors" : [ {  
      "domain" : "global",  
      "message" : "Request had insufficient authentication scopes.", 
      "reason" : "forbidden"  
      } ], 
     "message" : "Request had insufficient authentication scopes.", 
     "status" : "PERMISSION_DENIED" 
    }  
at shaded.com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:146) 
at shaded.com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:113) 
at shaded.com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:40) 
at shaded.com.google.api.client.googleapis.services.AbstractGoogleClientRequest$1.interceptResponse(AbstractGoogleClientRequest.java:321) 
at shaded.com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1049) 
at shaded.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:419) 
at shaded.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:352) 
at shaded.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:469)

I tried creating the GoogleCredential object with "https://www.googleapis.com/auth/cloudkms" and "https://www.googleapis.com/auth/cloud-all" scopes, but ended up with the same error. Please let me know if I'm missing something here.

P.S: I do have a valid GoogleCredential object as I'm able to print the access token.

Doesn't work with "googleapis.com/auth/cloud-platform" either. — Fayaz Ahmed

Guoqing Xu Guoqing Xu · Accepted Answer · 2018-04-05T06:52:30

For now it's not working as we restrict the API scopes on VMs. We are working on the feature to allow KMS. Stay tuned!

Update: we have pushed the change, so you should be able to access KMS now. Please give a try.

Google Cloud ML Engine: Unable to access Cloud KMS

1 Answers