403 Forbidden error POST - Google Cloud IoT

0
votes

Trying to access Google Cloud IoT API - POST method -

  1. Used this as reference as I am new to google cloud - https://github.com/GoogleCloudPlatform/java-docs-samples/tree/master/iot/api-client/manager
  2. I have created a Spring Boot Application and an account with google.
  3. Verified google credentials through CLI & a project ID has been linked with my project.
  4. I have checked the permissions assigned to my account it was Owner/admin.
  5. I have checked the quota allocated- haven't exceeded the amount.

I am trying to create a registry through the command line from my Spring Boot Application, but it is throwing the below error :

Exception in thread "main" com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 Forbidden POST https://cloudiot.googleapis.com/v1/projects/null/locations/us-central1/registries { "code": 403, "errors": [ { "domain": "usageLimits", "message": "Cloud IoT API has not been used in project xxxxxxxxxx90 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudiot.googleapis.com/overview?project=xxxxxxxxxx90 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.", "reason": "accessNotConfigured", "extendedHelp": "https://console.developers.google.com" } ], "message": "Cloud IoT API has not been used in project xxxxxxxxxx90 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudiot.googleapis.com/overview?project=xxxxxxxxxx90 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.", "status": "PERMISSION_DENIED" }

I have enabled the Cloud IoT API, still the error is thrown.

Also, on the console log, I can see the following suggestion :

Your application has authenticated using end user credentials from Google Cloud SDK. We recommend that most server applications use service accounts instead. If your application continues to use end user credentials from Cloud SDK, you might receive a "quota exceeded" or "API not enabled" error. For more information about service accounts, see https://cloud.google.com/docs/authentication/.

  • I have created a service account & activated it through CLI as well. It isn't helping.

Any suggestion, fresh perspective is highly appreciated. Please do let me know if any other info needs to be added. Thanks in advance.

1
spring-bootgithubgoogle-cloud-platformspring-boot-maven-plugingoogle-cloud-iot
In your Spring Boot application, how are you authenticating the client and sending the request? Are you passing a service account key file to the client object on creation? Posting some of your code where you create the client object and send the request in your code would help debug what's going on. My GUESS is without seeing it, that you are relying on default application credentials and not explicitly passing your service account key to the application. When you say "I have created a service account & activated it through CLI as well." does that mean you ran gcloud init? - Gabe Weiss
@GabeWeiss Apologies for the delay in response. Thank you for your response. Your set of questions helped me figure out the steps I missed during initial configuration. I had run this command - "gcloud auth activate-service-account [email protected] --key-file=/path/key.json --project=testproject". I was hoping this is enough rather than running the "gcloud init" command. I have corrected my mistake, now no longer getting the above error. - Shruthi Mulgund
@SakshiGatyan Apologies for the delay in response. Thank you for your response. I was trying to pass the generated json key, but as mentioned above I missed the gcloud init step. Also, I was trying to create the registry through code. - Shruthi Mulgund
Yup! Be wary of this btw, using Default Application Credentials via gcloud init means you're using user credentials, not a service account. This means that the process is running as you the user. This isn't terrible, but best practices are to use a service account not user credentials so you can port the application if you need to somewhere else where you might not be able to run gcloud init. - Gabe Weiss

1 Answers

1
votes

Referring to the troubleshooting documentation of cloud IoT, we get PERMISSION_DENIED when the user or the application is not authorized to make requests.

The information provided by you and the error messages suggests issues in authentication of your application with Cloud IoT API. You need to authenticate using a service account and provide correct credentials in your application. (ie provide correct GOOGLE_APPLICATION_CREDENTIALS variable)

So, to use Cloud IoT you need to

  • First enable the Google Cloud IoT API.
  • Create credentials - service account to use the API for your application, you can also grant roles to this service account
  • Generate a json key for this service account and use this key for authentication.

For more details refer to this link.

Besides, you can also create a device registry directly from the gcloud command. link