google cloud: service account permissions

0
votes

Task: I want to store all logs from my local computer to the google logs.

The problem I faced is that I cannot create a service account with correct permissions. Even if I will give owner permission still getting I'm permission denied error (ACCESS_TOKEN - its token from account json key):

cat data.json | http POST 
"https://logging.googleapis.com/v2/entries:write"
Authorization:"Bearer $ACCESS_TOKEN"

Response:
    {
"error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}

Currently, I have set: enter image description here and it still not working.

While debugging I decided to use the personal account with that type of access: enter image description here

And request with a token from my account works perfectly fine:

$ cat data.json | http POST 
"https://logging.googleapis.com/v2/entries:write"
Authorization:"Bearer `gcloud auth application-default print-access-token`"


HTTP/1.1 200 OK
Alt-Svc: quic=":443"; ma=2592000; v="44,43,39,35"
Cache-Control: private
Content-Encoding: gzip
Content-Type: application/json; charset=UTF-8
Date: Sun, 23 Dec 2018 21:38:05 GMT
Server: ESF
Transfer-Encoding: chunked
Vary: Origin
Vary: X-Origin
Vary: Referer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

{}

But if I'm using exported stackdriver-station-1.json credentials-file with golang/nodejs app I'm getting permission denied error:

enter image description here

the same example using a console and ACCESS_TOKEN generated from exported json file:

$ cat data.json | http POST
"https://logging.googleapis.com/v2/entries:write"
Authorization:"Bearer $ACCESS_TOKEN"

HTTP/1.1 403 Forbidden
Alt-Svc: quic=":443"; ma=2592000; v="44,43,39,35"
Cache-Control: private
Content-Encoding: gzip
Content-Type: application/json; charset=UTF-8
Date: Sun, 23 Dec 2018 22:39:51 GMT
Server: ESF
Transfer-Encoding: chunked
Vary: Origin
Vary: X-Origin
Vary: Referer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

{
"error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}

Any suggestions are welcome! For me, it seems like I'm missing some fundamental part of the google cloud permissions. Like I need to put some check mark in the cloud interface or something like that.

2
google-cloud-platformclouddevopsgcloudgoogle-cloud-iam
You are includig a lot of information that does not help. However, you need to edit your question to fix: 1) Do not include links to outside sources. Do not include pictures. Include all information in the body of your question as text. 2) Include the program code and show how you are loading and using the service account credentials. 3) Remove the sections of your question that work. That just clutters the question. – John Hanley
Thanks for the suggestion. cat data.json | http POST "logging.googleapis.com/v2/entries:write" Authorization:"Bearer $ACCESS_TOKEN" fails even if account have owner permission – Vlad
Edited my question for put a problem on the first place – Vlad
You still have pictures, no source code, where does $ACCESS_TOKEN come from, etc. Too many missing pieces to your problem. Please reread my comment if you would like help. – John Hanley
Well, that's a problem - for explain what is ACCESS TOKEN and how do I got it I need to write down all this additional information Since some part of the configuration, I did from web admin I included that as pictures + I cannot copy and paste any info from the machine i'm working on so I made a screenshot of what i'm getting – Vlad

2 Answers

0
votes

I'm facing the same problem and my conclusion is that the stackdriver API does not support access with an API Key only, even though you can create a API Key for several stackdriver roles.

You need to set up a Service Account and use the OAuth process. This may be tricky, when the access token needs to be renewed regularly.

https://developers.google.com/identity/protocols/OAuth2ServiceAccount

-1
votes

If you goes through documentation, you can get useful information about required roles.

roles/logging.viewer (Logs Viewer) gives members read-only access to all features of Logging, except the permission to read private logs.

roles/logging.privateLogViewer (Private Logs Viewer) gives members the permissions found in roles/logging.viewer, plus the permission to read private logs.

roles/logging.logWriter (Logs Writer) can be granted to members that are service accounts and gives members just enough permissions to write logs. This role does not grant access to the Logs Viewer.

roles/logging.configWriter (Logs Configuration Writer) gives members the permissions to create logs-based metrics and export sinks. To use the Logs Viewer, add the roles/logging.viewer role.

roles/logging.admin (Logging Admin) gives members all permissions related to Logging. For a full list of these permissions, see API Permissions. roles/viewer (Project Viewer) gives members the same permissions as roles/logging.viewer at the project level. Note that granting this role applies the permissions to most GCP services at the project level, and is not confined to usage of Logging.

roles/editor (Project Editor) gives members the same permissions as roles/logging.viewer, plus permissions to write log entries, delete logs, and create logs-based metrics, at the project level. The role does not let you create export sinks or read private logs. Note that granting this role applies the permissions to most GCP services at the project level, and is not confined to usage of Logging.

Source https://cloud.google.com/logging/docs/access-control

Based on this, you should give right permissions to your service account.

Second step to define how do you wanna authorize. For example you can use service account JSON to create & refresh token using custom python tool.

But anyway, if you need to write your logs to Stackdriver, my suggestion is to use Agent. This is the best option how to drop logs in right way.

https://cloud.google.com/logging/docs/agent/authorization

If you need to write logs from your application, you can easily use library and authoriza it using JSON key generated for specifict service account.