How to give permission to Google Spreadsheet created by Service Account?

Question

I created a Google Service Account with this step:

1. Open this link: https://console.cloud.google.com/apis/credentials?project=MyProject
2. Click on CREATE CREDENTIALS button, then select Service account
3. Fill the Service account details field like this. And then CREATE AND CONTINUE
4. On the Grant this service account access to project , click +ADD ROLE , then I select Quick Access -> Basic -> Owner , then CONTINUE

5. On the Grant users access to this service account , I fill it in with my normal email address. Then click on the DONE button.

Now I have something like this on my Service Accounts list:

6. Click on the service accounts, then go to the PERMISSIONS tab, then click on the GRANT ACCESS button:

7. Add principals with my email address, and I set the role as Service Account Admin , then SAVE .

8. Now click on the KEYS tab, then click on ADD KEY dropdown, and select Create new key

9. CREATE the key as JSON type.

10. After the JSON file gets downloaded I put it on my code path. And the code that I running is code from Google Spreadsheet API documentation to create a new spreadsheet, here is the snippet of the code:

    def create(title):
        creds = service_account.Credentials.from_service_account_file('odoo-spreadsheet-371808-7186d4c03b4c.json',
                                                                      scopes=SCOPES)
        service = build('sheets', 'v4', credentials=creds)
        spreadsheet = {
            'properties': {
                'title': title
            },
        }
        spreadsheet = service.spreadsheets().create(body=spreadsheet)
        response = spreadsheet.execute()
        print('response', response)
        print('spreadsheetId:', response.get('spreadsheetId'))
        print('spreadsheetUrl:', response.get('spreadsheetUrl'))

The code run successfully and created a new spreadsheet on the service account that I have created above, but when I open the spreadsheetUrl on my browser using the email that I have been granted like step number 5 and 7 like above, I got Access Denied, I'm seeing a screen like this which is mean I don't have access to the spreadsheet.

Isn't I already given my email access on the service account like step number 5 and 7 above?, So why my email still don't have permission to access the spreadsheet created by my service account?

Answer 1

I grant my email permission to the created spreadsheet using bellow snippet of code:

def update_spreadsheet_permission(drive_service, spreadsheet_id, type, role, email_address):
    new_file_permission = {
        'type': type,
        'role': role,
        'emailAddress': email_address,
    }

    permission_response = drive_service.permissions().create(
        fileId=spreadsheet_id, body=new_file_permission).execute()

    return permission_response

So far the code can grant permission to emails with role read and write . But the code can't change the spreadsheet type to owner yet.