通过使用 GCP 计算服务器上的 GCE 元数据服务器的服务帐户使用驱动器 API

Question

Have been successfully accessing files through the Drive API using a service account with access to those Drive files, by using the regular authentication with the.json credentials.

Now, we want to remove the usage of.json credentials and rely on the GCE Metadata server, as per described here https://github.com/googleapis/google-api-nodejs-client#:~:text=When%20running%20in%20GCP%2C%20service%20authorize%20is%20automatically%20provided%20via%20the%20GCE%20Metadata%20server . But I keep getting an Insufficient Permission: Request had insufficient authentication scopes. error, even though I'm setting the scopes the same way I was doing with the.json credentials, where the requests were successful.

Is it possible to access the Drive API using GCE Metadata tokens?

Answer 1

To access Drive, 2 conditions must be met:

1. The service account must be granted access to Drive
2. The VM must have been created with --scopes https://www.googleapis.com/auth/drive

I suspect you've missed (2). Note that Allow full access to all Cloud APIs doesn't include Drive since Drive isn't a Google Cloud API.