Unathenticated user error when exporting database table from MySQL in Gcloud

Question

I am running the follwing code in my gcloud cmd shell which is intended to export a specific table from my database to a storage bucket:

gcloud sql export sql databasen gs://my_bucket/file_nam,e.sql --async --database=database--table=table --offload

I keep on getting an error:

{
  "error": {
    "code": 401,
    "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
    "errors": [
      {
        "message": "Login Required.",
        "domain": "global",
        "reason": "required",
        "location": "Authorization",
        "locationType": "header"
      }
    ],
    "status": "UNAUTHENTICATED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "CREDENTIALS_MISSING",
        "domain": "googleapis.com",
        "metadata": {
          "method": "google.cloud.sql.v1beta4.SqlOperationsService.Get",
          "service": "sqladmin.googleapis.com"
        }
      }
    ]
  }

I have already authenticated myself in the shell with gcloud auth login and given CloudAdmin IAM authority to the service account for the sql instance. I also have all the cloudsql cloud APIs enabled.

I am at loss and would appreciate any direction here. Thank you!

Answer 1

Every request your application sends to the Cloud SQL Admin API needs to identify your application to Google.
This error can occur if you haven't set up the OAuth header properly.To address this issue, repeat the steps to verify your initial setup . When you run the code from your local machine, you need to make your own OAuth token accessible to the code by using one of the following authentication methods:
-- Using Service account :
Create a Service Account and download a JSON key. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of the downloaded service account key file (JSON). The same google.auth.default documentation code you use also checks this special environment variable for the set JSON OAuth token and uses it automatically.
You can check if the service account is the active one on the instance by running the following command: gcloud auth list

I would also recommend you check the official documentation for Export SQL and Best Practices Also do check these examples for similar implementation:

• Authorize Cloud sql admin api call
• Google Cloud admin authentication
• Permissions for google cloud sql export