GAE credentials not available on App Engine

Question

I am running a service on Google App Engine and I want to read some files from a Cloud Storage Bucket .

As I read here https://cloud.google.com/docs/authentication/production#obtaining_credentials_on_app_engine_standard_environment you can get the credentials implicitly or explicitly.

I am running the service on runtime java8 .

In my service I have tried the two ways but neither of them works.

Implicit way

StorageOptions.getDefaultInstance().getService();

When I apply the implicit way I always get this error

com.google.cloud.storage.StorageException: Anonymous caller does not have storage.buckets.get access to xxxxxxxxxx.
at com.google.cloud.storage.spi.v1.HttpStorageRpc.translate(HttpStorageRpc.java:229)
at com.google.cloud.storage.spi.v1.HttpStorageRpc.get(HttpStorageRpc.java:406)
at com.google.cloud.storage.StorageImpl$4.call(StorageImpl.java:215)
at com.google.cloud.storage.StorageImpl$4.call(StorageImpl.java:212)
at com.google.api.gax.retrying.DirectRetryingExecutor.submit(DirectRetryingExecutor.java:105)
at com.google.cloud.RetryHelper.run(RetryHelper.java:76)

Explicit way

GoogleCredentials credentials = AppEngineCredentials.getApplicationDefault();
storage = StorageOptions.newBuilder().setCredentials(credentials).build().getService();

By applying the explicit way for AppEngine I get this error

The Application Default Credentials are not available. They are available if running in Google Compute Engine. Otherwise, the environment variable GOOGLE_APPLICATION_CREDENTIALS must be defined pointing to a file defining the credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.

I am using the dependency

    <dependency>
        <groupId>com.google.cloud</groupId>
        <artifactId>google-cloud-storage</artifactId>
        <version>1.92.0</version>
    </dependency>

Running on local environment works.

Thanks in advance

Answer 1

The only code works for me on runtime java8 is this

import com.google.appengine.api.appidentity.AppIdentityService;
import com.google.appengine.api.appidentity.AppIdentityServiceFactory;
import com.google.auth.appengine.AppEngineCredentials;
import com.google.auth.oauth2.GoogleCredentials;
import com.google.cloud.storage.*;

AppIdentityService appIdentityService = AppIdentityServiceFactory.getAppIdentityService();
GoogleCredentials credentials = AppEngineCredentials.newBuilder().setAppIdentityService(appIdentityService).build();
storage = StorageOptions.newBuilder().setCredentials(credentials).build().getService();