Google Cloud Storage API: can't generate access token, access denied

user_10634757 0
Viewed 1221

I'm new to Google APIs and I've been trying for days to use a service account to upload content to a Google Cloud Storage bucket. I'm able to accomplish this, but only with a temporary access token obtained from the Google API playground, and I need to be able to get new access tokens so the service account can always upload content.

I've been experimenting with the following, but I keep getting access denied, even though the account in question has 'owner' permissions.

curl -X POST / -H "Authorization: Bearer "$(gcloud auth application-default print-access-token) \ -H "Content-Type: application/json; charset=utf-8" \ -d @Documents/request.json \ https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/content-uploader@kol-hatorah-kulah.iam.gserviceaccount.com:generateAccessToken

response:

{ "error": { "code": 403, "message": "The caller does not have permission", "status": "PERMISSION_DENIED" } }

When I run gcloud config list I get the correct project, and the account is my work email, which is also in Google Cloud as an owner.

Thanks in advance!

google-cloud-firestore google-cloud-storage oauth-2.0 google-cloud-platform google-api
2 Answers

DISCLAIMER - my solution works for Workload Identity Federation related problems.

I've had hard time with this error, but finally found it!

For me it was wrong attribute mapping.

I was following some tutorial (which probably went outdated) and mapping was different than from official github action task documentation (here)

I had repository_owner and aud. Changed it for repository and... It works!

To sum up my mapping looks like this:

"google.subject"                 = "assertion.sub"
"attribute.actor"                = "assertion.actor"
"attribute.repository"           = "assertion.repository"

So if you got here because of same tutorial... you've been served!

user_21280070

Your curl command is attempting to use a service account identity to generate an Access Token. The command is failing because you do not have permission.

Add the role roles/iam.serviceAccountTokenCreator to the identity running the command.

user_80167200
Related