TPU-VM gives access denied when accessing Bucket

Question

I have a number of Google cloud TPU-VMs which need to write to a Bucket.

Most of them work fine, but the one I created this morning is giving me Access Denied when I run gsutil -m cp test_file.txt gs://MY_BUCKET_NAME :

  "error": {
    "code": 403,
    "message": "Access denied.",
    "errors": [
      {
        "message": "Access denied.",
        "domain": "global",
        "reason": "forbidden"
      }
    ]

The VM is identical to all the others as far as I can see (same project, same versions, same region, same service account, gcloud config list and gcloud auth list give identical results) - any ideas why it's behaving differently?

This still happens even when I give allUsers public permissions to write to the bucket.

Answer 1

Have you checked the scope of the machine ( link )? It sounds like your machine has read-only scope instead of read_write .

How to verify:

• Go to the console, and select your TPU
• In the DETAILS tab, click Equivalent REST
• Check the scope under serviceAccount , and make sure you have https://www.googleapis.com/auth/devstorage.read_write

It likely happens when you create a TPU via GCP console as the default scope is read-only. But creating the machine with gCloud CLI won't cause this problem.