Google Cloud API 403 - Insufficient Permission

Question

I would like to extract the reporting data of our mobile apps from Google Play Console.

According to this documentation, we have to use SignedJwtAssertionCredentials to authenticate. After some errors and research it seems that the code snippet in the doc is kind of outdated (since SignedJWTAssertionCredentials is not available anymore). Instead we tried the following to automatically download the reports:

from oauth2client.service_account import  ServiceAccountCredentials
from apiclient.discovery import build

scopes = ['https://www.googleapis.com/auth/analytics.readonly']
key_file_location = 'files/access_token/mykeyfile.json'

credentials = ServiceAccountCredentials.from_json_keyfile_name(key_file_location, scopes)

cloud_storage_bucket = 'pubsite_prod_rev_123456789'
report_to_download = 'installs/installs_com.someapp.etc.etc_2021*'

storage = build('storage', 'v1', credentials=credentials)

print( storage.objects().get(bucket = cloud_storage_bucket,object = report_to_download).execute())

Now the problem is, that we receive the following error message:

Traceback (most recent call last):
  File "C:\Users\dev\dev\z_10_ext_google_play_store.py", line 30, in <module>
    print( storage.objects().get(bucket = cloud_storage_bucket,object = report_to_download).execute())
  File "D:\Software\Python\lib\site-packages\googleapiclient\_helpers.py", line 130, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "D:\Software\Python\lib\site-packages\googleapiclient\http.py", line 938, in execute
    raise HttpError(resp, content, uri=self.uri)
googleapiclient.errors.HttpError: <HttpError 403 when requesting https://storage.googleapis.com/storage/v1/b/pubsite_prod_rev_123456789/o/installs%2Finstalls_com.someapp.etc.etc_2021%2A?alt=json returned "Insufficient Permission". Details: "[{'message': 'Insufficient Permission', 'domain': 'global', 'reason': 'insufficientPermissions'}]">

Does anyone have an idea? Our service account even has admin rights in play console (which normally would be to much..)

UPDATE

As DaImTo pointed out, I was missing some scopes which lead me to a different line of scope definition:

scopes = ['https://www.googleapis.com/auth/analytics.readonly', 'https://www.googleapis.com/auth/devstorage.read_only'

,'https://www.googleapis.com/auth/cloud-platform.read_only']

But I still receive some errors, now because of the missing access token which is weird because the .json file contains everything necessary:

Traceback (most recent call last):
  File "C:\Users\andre\Desktop\DAWSE\z_10_ext_google_play_store.py", line 33, in <module>
    print( storage.objects().get(bucket = cloud_storage_bucket,object = report_to_download).execute())
  File "D:\Sonstige Programme\Python\lib\site-packages\googleapiclient\_helpers.py", line 130, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "D:\Sonstige Programme\Python\lib\site-packages\googleapiclient\http.py", line 923, in execute
    resp, content = _retry_request(
  File "D:\Sonstige Programme\Python\lib\site-packages\googleapiclient\http.py", line 191, in _retry_request
    resp, content = http.request(uri, method, *args, **kwargs)
  File "D:\Sonstige Programme\Python\lib\site-packages\oauth2client\transport.py", line 159, in new_request
    credentials._refresh(orig_request_method)
  File "D:\Sonstige Programme\Python\lib\site-packages\oauth2client\client.py", line 749, in _refresh
    self._do_refresh_request(http)
  File "D:\Sonstige Programme\Python\lib\site-packages\oauth2client\client.py", line 785, in _do_refresh_request
    self.access_token = d['access_token']
KeyError: 'access_token'

Answer 1

You appear to be using the objects.get method

The authenticated user must have sufficient permission to use this method. To start with i would ensure your service account has access.

After that i would check your scopes you are currently only loading the scope for google analytics api.

scopes = ['https://www.googleapis.com/auth/analytics.readonly']

This scope will not grant you access to the google cloud storage objects get method. For that you need to use one of the google cloud storage scopes