got "Failure: GetBucketIamPolicy must be overloaded" when gsutil iam get gs://test-bucket/ cmd is issued

Question

Google Cloud gsutil iam get gs://testBucket command should return bucket policy, but instead received "Failure: GetBucketIamPolicy must be overloaded"

Verified storage.buckets.GetIamPolicy and storage.buckets.setIamPolicy are in placed.

Any help or suggestion is appreciated.

Answer 1

That functionality only exists in the JSON API; it sounds like you've somehow managed to get gsutil to try using the XML API to make this call.

Here's the base API client class:

• https://github.com/GoogleCloudPlatform/gsutil/blob/0e4bdc80f90f42edd86c3da772c22087e63b21be/gslib/cloud_api.py#L84

And here are the subclasses that implement functionality for the JSON and XML API (note that GetBucketIamPolicy is only implemented in the JSON API's client class):

• https://github.com/GoogleCloudPlatform/gsutil/blob/0e4bdc80f90f42edd86c3da772c22087e63b21be/gslib/gcs_json_api.py#L334
• https://github.com/GoogleCloudPlatform/gsutil/blob/0e4bdc80f90f42edd86c3da772c22087e63b21be/gslib/boto_translation.py#L160

My best guess is that you have HMAC credentials configured in your boto file, rather than OAuth2 credentials. This will force gsutil to use the XML API (since HMAC credentials only work for that API), regardless of whether the command is supposed to support the XML API. The iam command is supposed to only support the JSON API, but it looks like we didn't add a test for the edge case where only HMAC credentials were configured.

I've filed https://github.com/GoogleCloudPlatform/gsutil/issues/846 to track this bug in gsutil.