Recovering access after initially provisioning wrong scopes for an instance

user_218340 0
Viewed 127

I recently created a VM, but mistakenly gave the default service account Storage: Read Only permissions instead of the intended Read Write under "Identity & API access", so GCS write operations from the VM are now failing.

enter image description here enter image description here

I realized my mistake, so following the advice in this answer, I stopped the VM, changed the scope to Read Write and started the VM. However, when I SSH in, I'm still getting 403 errors when trying to create buckets.

$ gsutil mb gs://some-random-bucket
Creating gs://some-random-bucket/...
AccessDeniedException: 403 Insufficient OAuth2 scope to perform this operation.
Acceptable scopes: https://www.googleapis.com/auth/cloud-platform

How can I fix this? I'm using the default service account, and don't have the IAM permissions to be able to create new ones.

$ gcloud auth list
Credentialed Accounts
ACTIVE  ACCOUNT
*       (projectnum)-compute@developer.gserviceaccount.com
service-accounts google-compute-engine google-cloud-storage permission-denied
3 Answers

Try creating the Google Cloud Storage bucket with your user account.

Type gcloud auth login and access the link you are provided, once there, copy the code and paste it into the command line.

Then do gsutil mb gs://bucket-name.

user_91468200

The security model has 2 things at play, API Scopes and IAM permissions. Access is determined by the AND of them. So you need an acceptable scope and enough IAM privileges in order to do whatever action.

  • API Scopes are bound to the credentials. They are represented by a URL like, https://www.googleapis.com/auth/cloud-platform.
  • IAM permissions are bound to the identity. These are setup in the Cloud Console's IAM & admin > IAM section.

This means you can have 2 VMs with the default service account but both have different levels of access.

For simplicity you generally want to just set the IAM permissions and use the cloud-platform API auth scope.

To check if you have this setup go to the VM in cloud console and you'll see something like:

Cloud API access scopes

Allow full access to all Cloud APIs

When you SSH into the VM by default gcloud will be logged in as the service account on the VM. I'd discourage logging in as yourself otherwise you more or less break gcloud's configuration to read the default service account.

Once you have this setup you should be able to use gsutil properly.

Jeremy_Edwards_420050

I will suggest you to try add the scope "cloud-platform" to the instance by running the gcloud command below

gcloud alpha compute instances set-scopes INSTANCE_NAME [--zone=ZONE] [--scopes=[SCOPE,…] [--service-account=SERVICE_ACCOUNT

As a scopes put "https://www.googleapis.com/auth/cloud-platform" since it give Full access to all Google Cloud Platform resources.

Here is gcloud documentation

user_97434180
Related