AccessDeniedException: 403 *** does not have storage.objects.list access to the Google Cloud Storage bucket

[quai20]

Hello there, I managed to set up the gcloud access via this step :

- name: GCS
  uses: google-github-actions/setup-gcloud@v0.2.0
  with:
     service_account_email : ${{ secrets.GCP_SA_MAIL }}
     service_account_key: ${{ secrets.GCP_SA_KEY }}          
     export_default_credentials: true

I guess this works, because it outputs this :

Activated service account credentials for: [***]
Successfully exported Default Application Credentials

However this next step does not :

 - name: Get data
   run: gsutil -m cp gs://pubsite_prod_7763943235860257566/stats/installs/* data/

I get the error : AccessDeniedException: 403 *** does not have storage.objects.list access to the Google Cloud Storage bucket.

I'm not sure that's it's related to gcloud action, maybe it's more on the service account I use (that does have the proper permission, but the bucket I tried to access is not mine, it's generated by google play console to share some stats reports). If you have any recommendations on my gcloud setup here, I'm all ears. If it's not related, feel free to close this.

Cheers,

[exelban]

Hi. The provided key does not have access to the storage.objects.list. It's not related to the action. Please recheck your key permissions.

[quai20]

Thanks for the reply @exelban . In my console.developers.google.com, the roles for the service account I use as credentials here are "Owner" and "Storage Admin" (this ones allows the storage.objects.list access).

[exelban]

I have noticed only now. You are using google-github-actions/setup-gcloud which has no relation to this action. But you still have the wrong credentials or permissions)

[quai20]

Oh yes my bad this was the wrong code. I did tested with your action too. The error being the same. Thanks anyway !

[exelban]

I suppose you providing the wrong key, or using the wrong env or args.

[quai20]

Actually it's working today, I believe there is some kind of latency somewhere in the process of creating the service account and changing permissions.