如何从Google Cloud Functions NodeJS连接到Google云端存储

Question

I have the following code sample that receives a bufferedImage along with it's mimeType and then uploads it to Google Cloud Storage.

Everything works fine, but for some reason my Google Cloud Function is getting an 403 error from the Storage API.

What do i have to do so that my GC Function has access to GC Storage?

I couldn't find anything in the documentation that would show me how to do this.

const { Storage } = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// Lists all buckets in the current project
const buckets = storage.getBuckets();

exports.uploadImage = (bucketName, fileName, imageBuffer, mimeType) => {
  return new Promise((resolve, reject) => {

    let bucket = storage.bucket(bucketName);

    let file = bucket.file(fileName);
    file.save(imageBuffer,
        {
            metadata: { contentType: `image/${mimeType}` },
        },
        ((error) => {
            error ? reject(error) : resolve()
        })
    );
  })
}

here is the error I'm getting

{"code":403,"errors":[{"domain":"global","reason":"forbidden","message":"directed-galaxy-221521@appspot.gserviceaccount.com does not have storage.objects.create access to blog/e33f9c9d-65f0-4a7f-8332-29846f770e6d."}],"message":"directed-galaxy-221521@appspot.gserviceaccount.com does not have storage.objects.create access to blog/e33f9c9d-65f0-4a7f-8332-29846f770e6d."}

Answer 1

A Cloud Function (CF) is executed by a specific service account (in your case directed-galaxy-221521@appspot.gserviceaccount.com ). From Runtime service account :

During function execution, Cloud Functions uses the service account PROJECT_ID@appspot.gserviceaccount.com as an identity.

Since you're getting 403 error when accessing your buckets/files it means they aren't publicly accessible, so you need to give the above-mentioned service account the necessary access permission(s) (at least storage.objects.create , mentioned in the error message) according to the Access Control Option you selected and configured for your storage.

Answer 2

So apparently Google Cloud has some glitches in it. For some reason, I'm not allowed to write to a bucket unless it has already been created. I changed the bucketName to an already existing bucket and I received a 200 response. Google Cloud should have sent a 404 response instead of a 403. 403 is misleading because 1. My service does have bucket creation privileges and 2. The bucket never existed in the first place. That's means that 404 Not Found would be the appropriate response. I hope this helps somebody.