谷歌 Stackdriver API 权限被拒绝

Question

I am trying to get metrics using Stackdriver API, using a service account. The account has "Owner" rights on the project. I am getting the below error for all the Stackdriver API calls. Other APIs like Spanner etc I am able to use the same service account.

com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: User is not authorized to access the project monitoring records.
        at com.google.api.gax.rpc.ApiExceptionFactory.createException(ApiExceptionFactory.java:55) ~[gax-1.16.0.jar:1.16.0]
        at com.google.api.gax.grpc.GrpcExceptionCallable$ExceptionTransformingFuture.setException(GrpcExceptionCallable.java:118) ~[gax-grpc-1.16.0.jar:1.16.0]
        at com.google.api.gax.grpc.GrpcExceptionCallable$ExceptionTransformingFuture.onFailure(GrpcExceptionCallable.java:101) ~[gax-grpc-1.16.0.jar:1.16.0]
        at com.google.api.core.ApiFutures$1.onFailure(ApiFutures.java:61) ~[api-common-1.2.0.jar:na]
        at com.google.common.util.concurrent.Futures$4.run(Futures.java:1123) ~[guava-20.0.jar:na]
        at com.google.common.util.concurrent.MoreExecutors$DirectExecutor.execute(MoreExecutors.java:435) ~[guava-20.0.jar:na]
        at com.google.common.util.concurrent.AbstractFuture.executeListener(AbstractFuture.java:900) ~[guava-20.0.jar:na]
        at com.google.common.util.concurrent.AbstractFuture.complete(AbstractFuture.java:811) ~[guava-20.0.jar:na]
        at com.google.common.util.concurrent.AbstractFuture.setException(AbstractFuture.java:675) ~[guava-20.0.jar:na]
        at io.grpc.stub.ClientCalls$GrpcFuture.setException(ClientCalls.java:492) ~[grpc-stub-1.9.0.jar:1.9.0]
        at io.grpc.stub.ClientCalls$UnaryStreamToFuture.onClose(ClientCalls.java:467) ~[grpc-stub-1.9.0.jar:1.9.0]
        at io.grpc.ForwardingClientCallListener.onClose(ForwardingClientCallListener.java:41) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.CensusStatsModule$StatsClientInterceptor$1$1.onClose(CensusStatsModule.java:684) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.ForwardingClientCallListener.onClose(ForwardingClientCallListener.java:41) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.CensusTracingModule$TracingClientInterceptor$1$1.onClose(CensusTracingModule.java:392) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.ClientCallImpl.closeObserver(ClientCallImpl.java:475) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.ClientCallImpl.access$300(ClientCallImpl.java:63) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.close(ClientCallImpl.java:557) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.access$600(ClientCallImpl.java:478) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInContext(ClientCallImpl.java:590) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37) ~[grpc-core-1.9.0.jar:1.9.0]
        at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:123) ~[grpc-core-1.9.0.jar:1.9.0]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) ~[na:1.8.0_161]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[na:1.8.0_161]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) ~[na:1.8.0_161]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) ~[na:1.8.0_161]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_161]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_161]
        at java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_161]
    Caused by: io.grpc.StatusRuntimeException: PERMISSION_DENIED: User is not authorized to access the project monitoring records.
        at io.grpc.Status.asRuntimeException(Status.java:526) ~[grpc-core-1.9.0.jar:1.9.0]
        ... 19 common frames omitted

I have set the environment variable GOOGLE_APPLICATION_CREDENTIALS to point to the the service account private key json.

export GOOGLE_APPLICATION_CREDENTIALS="/home/subhro/workspace/7193_spanner.json"

The metrics I am trying to retrieve are

• spanner.googleapis.com/api/request_count
• spanner.googleapis.com/instance/storage/used_byte
• spanner.googleapis.com/instance/cpu/utilization
• spanner.googleapis.com/instance/node_count

My gradle build has the following deps:

compile('com.google.guava:guava:20.0')
compile('com.google.cloud:google-cloud-spanner:0.33.0-beta'){
    exclude group: 'com.google.guava', module: 'guava'
}
compile('com.google.cloud:google-cloud-monitoring:0.33.0-beta'){
    exclude group: 'com.google.guava', module: 'guava'
}
compile('com.google.api-client:google-api-client:1.23.0'){
    exclude group: 'com.google.guava', module: 'guava'
}

Has some also faced this same issue? Please help.

Answer 1

Check that the configured projectId matches your GCP project id.

On the GCP console, near top-left there is a drop-down to select your project. Then Cloud overview > dashboard > Project ID