Zystkmt

I recently created a VM, but mistakenly gave the default service account Storage: Read Only permissions instead of the intended Read Write under "Identity & API access", so GCS write operations from the VM are now failing.

I realized my mistake, so following the advice in this answer, I stopped the VM, changed the scope to Read Write and started the VM. However, when I SSH in, I'm still getting 403 errors when trying to create buckets.

$ gsutil mb gs://some-random-bucket

Creating gs://some-random-bucket/...

AccessDeniedException: 403 Insufficient OAuth2 scope to perform this operation.

Acceptable scopes: https://www.googleapis.com/auth/cloud-platform

How can I fix this? I'm using the default service account, and don't have the IAM permissions to be able to create new ones.

$ gcloud auth list

Credentialed Accounts

ACTIVE  ACCOUNT

*       (projectnum)-compute@developer.gserviceaccount.com

Try creating the Google Cloud Storage bucket with your user account.

Type gcloud auth login and access the link you are provided, once there, copy the code and paste it into the command line.

Then do gsutil mb gs://bucket-name.

The security model has 2 things at play, API Scopes and IAM permissions. Access is determined by the AND of them. So you need an acceptable scope and enough IAM privileges in order to do whatever action.

• API Scopes are bound to the credentials. They are represented by a URL like, https://www.googleapis.com/auth/cloud-platform.


• IAM permissions are bound to the identity. These are setup in the Cloud Console's IAM & admin > IAM section.

This means you can have 2 VMs with the default service account but both have different levels of access.

For simplicity you generally want to just set the IAM permissions and use the cloud-platform API auth scope.

To check if you have this setup go to the VM in cloud console and you'll see something like:

Cloud API access scopes

Allow full access to all Cloud APIs

When you SSH into the VM by default gcloud will be logged in as the service account on the VM. I'd discourage logging in as yourself otherwise you more or less break gcloud's configuration to read the default service account.

Once you have this setup you should be able to use gsutil properly.