Google Cloud Storage access Client API

Question

I am having a really hard time getting Application Default Credientials /OAuth2.0 thing to work in my program...

Background:

I have a sensor device that collects images, and I want to store these images on google cloud storage in a bucket. Ideally the code will just run at a push of a button, so the authorization would need to occur when the program runs.

From reading and re-reading the docs, this is what I have going so far:

from oauth2client.client import GoogleCredentials
from google.cloud import storage
import google.auth
import os

# Establish cloud credientials with a locally
# stored service account key
home_path = os.path.expanduser('~') + "/Project/"
auth_file = "<service account access key file>.json"
auth_file_path = home_path + auth_file

# I'm trying two different ways to verify my credentials..
os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = auth_file_path
credentials, project_id = google.auth.default()

# Get storage bucket for image files
storage = storage.Client(project_id)
bucket = storage.lookup_bucket('bucket0000')

As a result, I get a traceback error:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<string>", line 110, in <module>
  File "/Users/joshua/anaconda/lib/python3.5/site-packages/google/cloud/storage/client.py", line 193, in lookup_bucket
    return self.get_bucket(bucket_name)
  File "/Users/joshua/anaconda/lib/python3.5/site-packages/google/cloud/storage/client.py", line 173, in get_bucket
    bucket.reload(client=self)
  File "/Users/joshua/anaconda/lib/python3.5/site-packages/google/cloud/storage/_helpers.py", line 99, in reload
    _target_object=self)
  File "/Users/joshua/anaconda/lib/python3.5/site-packages/google/cloud/_http.py", line 303, in api_request
    error_info=method + ' ' + url)
google.cloud.exceptions.Forbidden: 403 Caller does not have storage.buckets.get access to bucket bucket0000. (GET https://www.googleapis.com/storage/v1/b/bucket0000?projection=noAcl)

where it seems I'm still considered an anonymous user (per the googleapis.com link in the traceback)

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "required",
    "message": "Anonymous users does not have storage.buckets.get access to bucket bucket0000.",
    "locationType": "header",
    "location": "Authorization"
   }
  ],
  "code": 401,
  "message": "Anonymous users does not have storage.buckets.get access to bucket bucket0000."
 }
}

trying again, this time with google.auth, I created a credential variable, and observing what prints it seems valid:<oauth2client.service_account._JWTAccessCredentials object at 0x107df0358>

I tried putting this credentials variable into storage.Client(), but that doesn't seem to work.

# Get storage bucket for image files
storage = storage.Client(project_id, credentials=credentials)
bucket = storage.lookup_bucket('bucket0000')

>>> Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<string>", line 6, in <module>
  File "/Users/joshua/anaconda/lib/python3.5/site-packages/google/cloud/storage/client.py", line 59, in __init__
    _http=_http)
  File "/Users/joshua/anaconda/lib/python3.5/site-packages/google/cloud/client.py", line 212, in __init__
    Client.__init__(self, credentials=credentials, _http=_http)
  File "/Users/joshua/anaconda/lib/python3.5/site-packages/google/cloud/client.py", line 126, in __init__
    raise ValueError(_GOOGLE_AUTH_CREDENTIALS_HELP)
ValueError: This library only supports credentials from google-auth-library-python. See https://google-cloud-python.readthedocs.io/en/latest/google-cloud-auth.html for help on authentication with this library

Of course, this traceback directs me to the page google-cloud-python.readthedocs.io ... which doesn't exist ...

Any way to get API calls to the Cloud Storage to work without using the console/web log in?

much appreciated!

Answer 1

It seems you didn't give your credential the authority for managing Storage. You can easily apply to it in IAM or under each bucket.