Authentication Issue while loading apigee data logs to cloud logging

[ahitankar]

Hi Team,

We are currently trying to log Apigee data to Google Cloud Logging using the Message Logging policy, which involves service account authentication. Although the service account has been granted the necessary permissions (roles/iam.serviceAccountTokenCreator and roles/logging.logWriter)(Screenshot attached), we are encountering the below error.

The same setup is functioning as expected on our internal Apigee X instance. However, when attempting the same configuration on our client's Apigee Hybrid instance, it is failing to authenticate, preventing the logs from being uploaded.

Could you please assist us in troubleshooting this issue? Any help or guidance on resolving this discrepancy between Apigee X and Apigee Hybrid would be greatly appreciated.

[williamssean · Accepted solution]

I wonder if this is because Apigee hybrid also has a runtime Service Account that must have the correct permissions.  If you look at this table it says the following for the Apigee hybrid runtime service account:

"Allows the Apigee runtime to generate tokens to authenticate on Google services requested by an API proxy. This service account "impersonates" the proxy-specific service account to make authenticated calls on its behalf."

Can you grant your Apigee hybrid runtime SA the roles/iam.serviceAccountTokenCreator role and see if that resolves it?

[ahitankar]

Thanks Williamssean. It solved the issue.