Search code examples
google-cloud-storagegoogle-compute-enginepermission-deniedservice-accounts

Recovering access after initially provisioning wrong scopes for an instance

I recently created a VM, but mistakenly gave the default service account Storage: Read Only permissions instead of the intended Read Write under "Identity & API access", so GCS write operations from the VM are now failing.

enter image description here enter image description here

I realized my mistake, so following the advice in this answer, I stopped the VM, changed the scope to Read Write and started the VM. However, when I SSH in, I'm still getting 403 errors when trying to create buckets.

$ gsutil mb gs://some-random-bucket
Creating gs://some-random-bucket/...
AccessDeniedException: 403 Insufficient OAuth2 scope to perform this operation.
Acceptable scopes: https://www.googleapis.com/auth/cloud-platform

How can I fix this? I'm using the default service account, and don't have the IAM permissions to be able to create new ones.

$ gcloud auth list
Credentialed Accounts
ACTIVE  ACCOUNT
*       (projectnum)[email protected]
Solution

  • I will suggest you to try add the scope "cloud-platform" to the instance by running the gcloud command below

    gcloud alpha compute instances set-scopes INSTANCE_NAME [--zone=ZONE] [--scopes=[SCOPE,…] [--service-account=SERVICE_ACCOUNT

    As a scopes put "https://www.googleapis.com/auth/cloud-platform" since it give Full access to all Google Cloud Platform resources.

    Here is gcloud documentation