服务帐户没有对Google Cloud Storage的storage.objects.get访问权限 [英] service account does not have storage.objects.get access for Google Cloud Storage

问题描述

我已经在Google Cloud Console中创建了一个服务帐户，并选择了角色Storage/Storage Admin(即，完全控制GCS资源).

I have created a service account in Google Cloud Console and selected role Storage / Storage Admin (i.e. full control of GCS resources).

gcloud projects get-iam-policy my_project似乎指示该角色实际上已被选择:

gcloud projects get-iam-policy my_project seems to indicate that the role was actually selected:

- members:
  - serviceAccount:my_sa@my_project.iam.gserviceaccount.com
  role: roles/storage.admin
- members:
  - serviceAccount:my_sa@my_project.iam.gserviceaccount.com
  role: roles/storage.objectAdmin
- members:
  - serviceAccount:my_sa@my_project.iam.gserviceaccount.com
  role: roles/storage.objectCreator

文档明确表明角色roles/storage.admin包括权限storage.objects.*(以及storage.buckets.*).

And documentation clearly indicates that role roles/storage.admin comprises permissions storage.objects.* (as well as storage.buckets.*).

但是当我尝试将该服务帐户与适用于Python的Google Cloud Storage客户端库结合使用时，会收到以下错误消息:

But when I try using that service account in conjunction with the Google Cloud Storage Client Library for Python, I receive this error message:

my_sa@my_project.iam.gserviceaccount.com没有 storage.objects.获取对my_project/my_bucket的访问权限.

my_sa@my_project.iam.gserviceaccount.com does not have storage.objects.get access to my_project/my_bucket.

那为什么在这种情况下所选角色还不够?

So why would the selected role not be sufficient in this context?

推荐答案

问题显然是服务帐户与太多角色相关联，这可能是先前配置尝试的结果.

The problem was apparently that the service account was associated with too many roles, perhaps as a results of previous configuration attempts.

这些步骤解决了该问题:

These steps resolved the issue:

• 删除了IAM & Admin/IAM
下有问题的服务帐户(成员)my_sa的所有(三个)角色
• 在IAM & Admin/Service accounts
下删除了my_sa
• 重新创建my_sa(同样是角色Storage/Storage Admin)

• removed all (three) roles for the offending service account (member) my_sa under IAM & Admin / IAM
• deleted my_sa under IAM & Admin / Service accounts
• recreated my_sa (again with role Storage / Storage Admin)

效果如下:

• my_sa在IAM & Admin/IAM
下以一种角色(Storage Admin)出现
• my_sa显示为Storage/Browser/my_bucket/Edit bucket permissions
下的成员

• my_sa shows up with one role (Storage Admin) under IAM & Admin / IAM
• my_sa shows up as member under Storage / Browser / my_bucket / Edit bucket permissions

这篇关于服务帐户没有对Google Cloud Storage的storage.objects.get访问权限的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！