User/service account, scope, AppEngine and GSuite (sheet v4 api)

Question

I build this very simple code, very similar to the tutorial here. I simply use the default credential, instead of using a service account key file (I can explain why if required, but in short, it's not secured!)

To test it, simply change the sheet ID in the code

import os
from flask import Flask, request

app = Flask(__name__)

@app.route('/', methods=['GET','POST'])
def test_sheet():

    from googleapiclient.discovery import build
    import google.auth

    SCOPES = ['https://www.googleapis.com/auth/spreadsheets.readonly']

    credentials, project_id = google.auth.default(scopes=SCOPES)
    # The ID and range of a sample spreadsheet.
    SAMPLE_SPREADSHEET_ID = '1oHzQLk79_TeEZtQyTLxk47PKDi7g1oy1O0MgSHzhUSk'
    SAMPLE_RANGE_NAME = 'A1:C1'

    service = build('sheets', 'v4', credentials=credentials)

    sheet = service.spreadsheets()
    result = sheet.values().get(spreadsheetId=SAMPLE_SPREADSHEET_ID,
                                range=SAMPLE_RANGE_NAME).execute()
    values = result.get('values', [])

    if not values:
        print('No data found.')
    else:
        print('Results:')
        for row in values:
            # Print columns A and E, which correspond to indices 0 and 4.
            print(row)
            return row[0] + ',' + row[1], 200

if __name__ == "__main__":
    app.run(host='0.0.0.0',port=int(os.environ.get('PORT',8080)))

Anyway, here my problem:

When I deploy it on Cloud Run, and I authorize the Cloud Run custom service account (without key, I use the application default credential) on my spreadsheet, it works
When, locally, I use a service account key file of the Cloud Run that I set in the GOOGLE_APPLICATION_CREDENTIALS, it works (bad practice as I said in introduction)
When, locally, I use my user credentials authorized on my sheet (gather with gcloud auth application-default login) it doesn't work with this error: 403.......Request had insufficient authentication scopes.
When I deploy on App Engine, and I authorize the AppEngine default service account (@appspot.gserviceaccount.com), it doesn't work with this error: 403.......Request had insufficient authentication scopes.

QUESTIONS

Why I can't change the scope of the user account credential? I could understand this case. I can't invoke private Cloud Function and private Cloud Run with my user credential. Why not another limitation!
Why I can't change the scope of the App Engine default service account? Here I don't catch the differences with the other service accounts on GCP

User/service account, scope, AppEngine and GSuite (sheet v4 api)

Answers (1)

Related Questions