Request had insufficient authentication scopes (403) when trying to write crawling data to Bigquery from pipeline of Scrapy

Question

I'm trying to build Scrapy crawler: spider will crawl data then in pipeline.py, the data will save to Bigquery. I built it by docker, setup crontab job and push to Google Cloud Server to daily running.

The problem is when crontab executes scrapy crawler, it got "google.api_core.exceptions.Forbidden: 403 GET https://www.googleapis.com/bigquery/v2/projects/project_name/datasets/dataset_name/tables/table_name: Request had insufficient authentication scopes.".

For more detail, when accessing to its container(docker exec -it ... /bin/bash) and execute it manually(scrapy crawl spider_name), it works like charm. The data appears in Bigquery.

I use service account (json file) having bigquery.admin role to setup GOOGLE_APPLICATION_CREDENTIALS.

# spider file is fine

# pipeline.py
from google.cloud import bigquery
import logging
from scrapy.exceptions import DropItem
...

class SpiderPipeline(object):
    def __init__(self):

        # BIGQUERY
        # Setup GOOGLE_APPLICATION_CREDENTIALS in docker file
        self.client = bigquery.Client()
        table_ref = self.client.dataset('dataset').table('data')
        self.table = self.client.get_table(table_ref)

    def process_item(self, item, spider):
        if item['key']:

            # BIGQUERY
            '''Order: key, source, lang, created, previous_price, lastest_price, rating, review_no, booking_no'''
            rows_to_insert = [( item['key'], item['source'], item['lang'])]
            error = self.client.insert_rows(self.table, rows_to_insert)
            if error == []:
                logging.debug('...Save data to bigquery {}...'.format(item['key']))
                # raise DropItem("Missing %s!" % item)
            else:
                logging.debug('[Error upload to Bigquery]: {}'.format(error))

            return item
        raise DropItem("Missing %s!" % item)

In docker file:

FROM python:3.5-stretch

WORKDIR /app

COPY requirements.txt ./

RUN pip install --trusted-host pypi.python.org -r requirements.txt

COPY . /app

# For Bigquery
# key.json is already in right location
ENV GOOGLE_APPLICATION_CREDENTIALS='/app/key.json'

# Sheduler cron

RUN apt-get update && apt-get -y install cron

# Add crontab file in the cron directory
ADD crontab /etc/cron.d/s-cron

# Give execution rights on the cron job
RUN chmod 0644 /etc/cron.d/s-cron

# Apply cron job
RUN crontab /etc/cron.d/s-cron

# Create the log file to be able to run tail
RUN touch /var/log/cron.log

# Run the command on container startup
CMD cron && tail -f /var/log/cron.log

In crontab:

# Run once every day at midnight. Need empty line at the end to run.
0 0 * * * cd /app && /usr/local/bin/scrapy crawl spider >> /var/log/cron.log 2>&1

In conclusion, how to get crontab run crawler without 403 error. Thank anyone so much for support.

Answer 1

I suggest you load the service account directly in your code and not from the environment like this:

from google.cloud import bigquery
from google.cloud.bigquery.client import Client
service_account_file_path = "/app/key.json" # your service account auth file file
client = bigquery.Client.from_service_account_json(service_account_file_path)

The rest of the code should stay the same as you verify it's a working code