Google Cloud Storage 500 Internal Server Error 'Google::Cloud::Storage::SignedUrlUnavailable'

2
votes

Trying to get Google Cloud Storage working on my app. I successfully saved an image to a bucket, but when trying to retrieve the image, I receive this error:

GCS Storage (615.3ms) Generated URL for file at key: 9A95rZATRKNpGbMNDbu7RqJx ()
Completed 500 Internal Server Error in 618ms (ActiveRecord: 0.2ms)

Google::Cloud::Storage::SignedUrlUnavailable (Google::Cloud::Storage::SignedUrlUnavailable):

Any idea of what's going on? I can't find an explanation for this error in their documentation.

3
google-cloud-storage
Does this error happen repeatedly for that request? If so, can you please send details (the bucket and object name, request time, what library you are using) to [email protected]? That will go to the GCS team, so won't expose your details on this public forum. - Mike Schwartz
Thank you Mike, I actually figured it out. My GCS keyfile for config/storage.yml wasn't set up properly, which caused this error. Slightly confusing because I was able to write to storage no problem, I just couldn't read files and wasn't receiving a 401/403 error. - Josh Bradley
@JoshBradley Could you post the solution as an answer, please? - Rubén C.

3 Answers

5
votes

To provide some explanation here...

Google App Engine (as well as Google Compute Engine, Kubernetes Engine, and Cloud Run) provides "ambient" credentials associated with the VM or instance being run, but only in the form of OAuth tokens. For most API calls, this is sufficient and convenient.

However, there are a small number of exceptions, and Google Cloud Storage is one of them. Recent Storage clients (including the google-cloud-storage gem) may require a full service account key to support certain calls that involve signed URLs. This full key is not provided automatically by App Engine (or other hosting environments). You need to provide one yourself. So as a previous answer indicated, if you're using Cloud Storage, you may not be able to depend on the "ambient" credentials. Instead, you should create a service account, download a service account key, and make it available to your app (for example, via the ActiveStorage configs, or by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable).

3
votes

I was able to figure this out. I had been following Rail's guide on Active Storage with Google Storage Cloud, and was unclear on how to generate my credentials file.

google:
  service: GCS
  credentials: <%= Rails.root.join("path/to/keyfile.json") %>
  project: ""
  bucket: ""

Initially, I thought I didn't need a keyfile due to this sentence in Google's Cloud Storage authentication documentation:

If you're running your application on Google App Engine or Google Compute Engine, the environment already provides a service account's authentication information, so no further setup is required.

(I am using Google App Engine)

So I commented out the credentials line and started testing. Strangely, I was able to write to Google Cloud Storage without issue. However, when retrieving the image I would receive the 500 server error Google::Cloud::Storage::SignedUrlUnavailable.

I fixed this by generating my private key and adding it to my rails app.

0
votes

Another possible solution as of google-cloud-storage gem version 1.27 in August 2020 is documented here. My Google::Auth.get_application_default as in the documentation returned an empty object, but using Google::Cloud::Storage::Credentials.default.client instead worked.

If you get Google::Apis::ClientError: badRequest: Request contains an invalid argument response when signing check that you have dash in the project name in the signing URL (i.e projects/-/serviceAccounts explicit project name in the path is deprecated and no longer valid) and that you have "issuer" string correct, as the full email address identifier of the service account not just the service account name.

If you get Google::Apis::ClientError: forbidden: The caller does not have permission verify the roles your Service Account have:

gcloud projects get-iam-policy <project-name>
  --filter="bindings.members:<sa_name>"
  --flatten="bindings[].members" --format='table(bindings.role)'

=> ROLE
     roles/iam.serviceAccountTokenCreator
     roles/storage.admin

serviceAccountTokenCreator is required to call the signBlob service, and you need storage.admin to have ownership of the thing you need to sign. I think these are project global rights, I couldn't get it to work with more fine grained permissions unfortunately (i.e one app is admin for a certain Storage bucket)