尝试使用 REST API 公开对象时出现“访问被拒绝。提供的范围未被授权”错误

Question

I am attempting to set permissions on individual objects in a Google Cloud Storage bucket to make them publicly viewable, following the steps indicated in Google's documentation . When I try to make these requests using our application service account, it fails with HTTP status 403 and the following message:

Access denied. Provided scope(s) are not authorized.

Other requests work fine. When I try to do the same thing but by providing a token for my personal account, the PUT request to the object's ACL works... about 50% of the time (the rest of the time it is a 503 error, which may or may not be related).

Changing the IAM policy for the service account to match mine - it normally has Storage Admin and some other incidental roles - doesn't help, even if I give it the overall Owner IAM role, which is what I have.

Using neither the XML API nor the JSON version makes a difference. That the request sometimes works with my personal credentials indicates to me that the request is not incorrectly formed, but there must be something else I've thus far overlooked. Any ideas?

Answer 1

Check for the scope of the service account incase you are using the default compute engine service account. By default the scope is restricted and for GCS it is read only. Use rm -r ~/.gsutil to clear cache in case of clearing cache

Answer 2

Follow the documentation you provided, taking into account these points:

• Access Control system for the bucket has to be Fine-grained (not uniform).

• In order to make objects publicly available, make sure the bucket does not have the public access prevention enabled. Check this link for further information.

• Grant the service account with the appropriate permissions in the bucket . The Storage Legacy Object Owner role ( roles/storage.legacyObjectOwner ) is needed to edit objects ACLs as indicated here . This role can be granted for individual buckets, not for projects.

• Create the json file as indicated in the documentation.

• Use gcloud auth application-default print-access-token to get authorization access token and use it in the API call. The API call should look like:

curl -X POST --data-binary @JSON_FILE_NAME.json \
  -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
  -H "Content-Type: application/json" \
  "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME/o/OBJECT_NAME/acl"

Answer 3

You need to add OAuth scope: cloud-platform when you create the instance. Look: https://cloud.google.com/sdk/gcloud/reference/compute/instances/create#--scopes

Either select " Allow full access to all Cloud APIs " or select the fine-grained approach

Answer 4

When trying to access GCS from a GCE instance and getting this error message ...
the default scope is devstorage.read_only , which prevents all write operations.

Not sure if scope https://www.googleapis.com/auth/cloud-platform is required, when scope https://www.googleapis.com/auth/devstorage.read_only is given by default (eg. to read startup scripts). The scope should rather be: https://www.googleapis.com/auth/devstorage.read_write .

---

And one can use gcloud beta compute instances set-scopes to edit the scopes of an instance:

gcloud beta compute instances set-scopes $INSTANCE_NAME \
  --project=$PROJECT_ID \
  --zone=$COMPUTE_ZONE \
  --scopes=https://www.googleapis.com/auth/devstorage.read_write \
  --service-account=$SERVICE_ACCOUNT

One can also pass all known alias names for scopes, eg: --scopes=cloud-platform . The command must be run outside of the instance, because of permissions - and the instance must be shutdown, in order to change the service account.

Answer 5

So, years later, it turns out the problem is that "scope" is being used by the Google Cloud API to refer to two subtly different things. One is the available permission scopes available to the service account, which is what I (and most of the other people who answered the question) kept focusing on, but the problem turned out to be something else. The Python class google.auth.credentials.Credentials , used by various Google Cloud client classes to authenticate, also has permission scopes used for OAuth. You see where this is going - the client I was using was being created with a default OAuth scope of 'https://www.googleapis.com/auth/devstorage.read_write' , but to make something public requires the scope 'https://www.googleapis.com/auth/devstorage.full_control' . Adding this scope to the OAuth credential request means the setting public permissions on objects works.