google.api_core.exceptions.PermissionDenied: 403 Error opening file

Question

I am trying out Google Cloud Vision API for Detect text in files (PDF/TIFF) using its Python sample, and came across this error:

google.api_core.exceptions.PermissionDenied: 403 Error opening file: gs://input_folder/input.pdf

I am instantiating the client via the json key using

client = vision.ImageAnnotatorClient(credentials=vision_credentials)

I have created the service account with the following permission: Owner, Storage Admin, Storage Object Admin, Storage Transfer Admin. Please note that I am utilising Google bucket.

Traceback (most recent call last):
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\google\api_core\grpc_helpers.py", line 57, in error_remapped_callable
    return callable_(*args, **kwargs)
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\grpc\_channel.py", line 565, in __call__
    return _end_unary_response_blocking(state, call, False, None)
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\grpc\_channel.py", line 467, in _end_unary_response_blocking
    raise _Rendezvous(state, None, None, deadline)
grpc._channel._Rendezvous: <_Rendezvous of RPC that terminated with:
        status = StatusCode.PERMISSION_DENIED
        details = "Error opening file: gs://input_folder/input.pdf."
        debug_error_string = "{"created":"@1564912541.032000000","description":"Error received from peer ipv4:172.217.194.95:443","file":"src/core/lib/surface/call.cc","file_line":1052,"grpc_message":"Error opening file: gs://input_folder/input.pdf.","grpc_status":7}"

The above exception was the direct cause of the following exception:
Traceback (most recent call last):
  File "notepad.py", line 105, in <module>
    async_detect_document("gs://input_folder/input.pdf", "gs://output_folder_results/")
  File "notepad.py", line 62, in async_detect_document
    requests=[async_request])
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\google\cloud\vision_v1\gapic\image_annotator_client.py", line 484, in async_batch_annotate_files
    request, retry=retry, timeout=timeout, metadata=metadata
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\google\api_core\gapic_v1\method.py", line 143, in __call__
    return wrapped_func(*args, **kwargs)
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\google\api_core\retry.py", line 273, in retry_wrapped_func
    on_error=on_error,
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\google\api_core\retry.py", line 182, in retry_target
    return target()
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\google\api_core\timeout.py", line 214, in func_with_timeout
    return func(*args, **kwargs)
  File "C:\Users\Eva\AppData\Local\Programs\Python\Python37\lib\site-packages\google\api_core\grpc_helpers.py", line 59, in error_remapped_callable
    six.raise_from(exceptions.from_grpc_error(exc), exc)
  File "<string>", line 3, in raise_from
google.api_core.exceptions.PermissionDenied: 403 Error opening file: gs://input_folder/input.pdf.

My codes:

from google.oauth2 import service_account
from google.cloud import vision
from google.cloud import storage
from google.protobuf import json_format
# Supported mime_types are: 'application/pdf' and 'image/tiff'
mime_type = 'application/pdf'

batch_size = 2

# Google credentials
VISION_SCOPES = ['https://www.googleapis.com/auth/cloud-vision']
SERVICE_ACCOUNT_FILE = 'C:\\Users\\Eva\\Desktop\\GoogleOCR\\cred.json'
vision_credentials = service_account.Credentials.from_service_account_file(SERVICE_ACCOUNT_FILE, scopes=VISION_SCOPES)

# Instantiates a client
client = vision.ImageAnnotatorClient(credentials=vision_credentials)

# Sample code
def async_detect_document(gcs_source_uri, gcs_destination_uri):
    feature = vision.types.Feature(
        type=vision.enums.Feature.Type.DOCUMENT_TEXT_DETECTION)

    gcs_source = vision.types.GcsSource(uri=gcs_source_uri)
    print(gcs_source)
    input_config = vision.types.InputConfig(
        gcs_source=gcs_source, mime_type=mime_type)

    gcs_destination = vision.types.GcsDestination(uri=gcs_destination_uri)
    print(gcs_destination)
    output_config = vision.types.OutputConfig(
        gcs_destination=gcs_destination, batch_size=batch_size)

    async_request = vision.types.AsyncAnnotateFileRequest(
        features=[feature], input_config=input_config,
        output_config=output_config)
    print(async_request)
    operation = client.async_batch_annotate_files(
        requests=[async_request])

    print('Waiting for the operation to finish.')
    operation.result(timeout=180)

    storage_client = storage.Client()

    match = re.match(r'gs://([^/]+)/(.+)', gcs_destination_uri)
    bucket_name = match.group(1)
    prefix = match.group(2)

    bucket = storage_client.get_bucket(bucket_name)

    blob_list = list(bucket.list_blobs(prefix=prefix))
    print('Output files:')
    for blob in blob_list:
        print(blob.name)
.
    output = blob_list[1]

    json_string = output.download_as_string()
    response = json_format.Parse(
        json_string, vision.types.AnnotateFileResponse())

    first_page_response = response.responses[0]
    annotation = first_page_response.full_text_annotation

    print(u'Full text:\n{}'.format(
        annotation.text))

async_detect_document("gs://input_folder/input.pdf", "gs://output_folder_results/")

Update: I tried setting the bucket object public access to AllUsers, and am still receiving the same error line

Update 2: Posted full traceback error

Update 3: Posted my codes

Answer 1

I encountered a similar issue, despite having correctly configured all my environments. I was utilizing the JSON file supplied by my employer, and I received the necessary permissions in the API key. Nevertheless, I consistently encountered the same error. To address this problem, I took the initiative to create my own account, enabled billing, and provided my payment details. It's worth noting that you'll receive a $405 free trial that lasts for 90 days. Even after this trial period expires, you won't incur automatic charges. You'll be presented with the choice to activate billing, which you can deactivate at any time to close your account.

Answer 2

I don't think the credentials argument does what you think it does. If you have your credentials in a JSON file, you need to set the environment variable GOOGLE_APPLICATION_CREDENTIALS with the path to the JSON file. Alternatively, if you have the JSON file contents loaded into a variable, e.g. info, you can do:

from google.oauth2.service_account import Credentials

vision_credentials = Credentials.from_service_account_info(info)
client = vision.ImageAnnotatorClient(credentials=vision_credentials)