Solved: Service account stopped working - Page 2

arik · 01-24-2023 09:30 AM

I've been using a service account to load data into my gcp bucket.
It was working fine for a year, and suddenly I started getting a permission saying:

AccessDeniedException: 403 ***@***.iam.gserviceaccount.com does not have storage.buckets.get access to the Google Cloud Storage bucket. Permission 'storage.buckets.get' denied on resource (or it may not exist).

I checked the service account roles, and it has "Storage Object Admin"
In addition it wasn't changed recently.

Any idea what's the issue here?

arik

Thanks again @kolban , I found the root cause.
On my local machine I was running gsutil version 4.59.
I assumed the cause might be that github actions use the lates gsutil version each time it runs.
So I updated my local gsutil version to latest, which is 5.18.
And voila... now it failed locally as well.
On the old version, gsutil wasn't asking for the storage.buckets.get permission. (verified that on the gcp bucket access logs)

Adding this permission to my service account solved the issue.

Thanks for the help!

View solution in original post