Google CloudLogging with service account - PERMISSION_DENIED error

user_1430394 0
Viewed 430

I'm trying to send logs from my Node.js app to GCP CloudLogging. I'm using nodejs-logging-bunyan. I followed the auth setup guide for a service account.

I can see the file being loaded. The following command

  console.log(process.env.GOOGLE_APPLICATION_CREDENTIALS)

yields the name of the service-account's auth-credentials json file. But when running the logger, I get the following error from the lib:

events.js:292
      throw er; // Unhandled 'error' event
      ^
Error: 7 PERMISSION_DENIED: The caller does not have permission
    ...
Emitted 'error' event on LoggingBunyan instance at:
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at emitErrorCloseNT (internal/streams/destroy.js:74:3)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  code: 7,
  details: 'The caller does not have permission',
  metadata: Metadata { internalRepr: Map(0) {}, options: {} },
  note: 'Exception occurred in retry method that was not classified as transient'
}

Furthermore, I use the same service account app credentials for accessing the SecretManager. Which proves to me that the app credentials are loaded correctly. So, this makes me think that I just need to add the proper permissions to the service account.

But I could not find anywhere in the documentation a mention of adding "logging permissions" to the service account. The only role they give as example is owner/editor, but that's way too high.

Any idea what am I missing? And if it's just the right permissions to the service acc, then what are they?

google-cloud-logging service-accounts google-cloud-platform
1 Answers

I had to add the proper permission for the service-account role: logging.logEntries.create. The issue was that the documentation doesn't mention the need for setting up permissions in order to write to the logs.

Furthermore, when I was setting up the role initially, I tried to search for "Cloud Logging" in the list of roles and nothing relevant came up.

Then I searched for just "Logs" and the proper role group (Logs Writer) came out.

user_14303940
Related