Google Api - Access is denied from c#, works with python

Question

Facing an access problem using the google Api NuGet: Using google v3 Environment.SetEnvironmentVariable("GOOGLE_APPLICATION_CREDENTIALS", _googleApiParams.CredentialsPath /path to JSON file/); _translationClient = TranslationServiceClient.Create();

            DetectLanguageRequest request = new()
            {
                Parent = "projects/my-project-name",
                Content = "this is a detection test"
            };

My Error: the exception:

Grpc.Core.RpcException: 'Status(StatusCode="PermissionDenied", Detail="Cloud IAM permission 'cloudtranslate.languageDetectionModels.predict' denied. ")

This python code works howerver:

self.translate_client = translate.Client.from_service_account_json(self.google_api_credentials_json_path)
                translated_text = self.translate_client.translate(values="this is a test", target_language=target_language,

Any Ideas for a fix?

Edit: Tried a dif approach, still the same error, same credentials work with python

 var credentialsPath = Environment.GetEnvironmentVariable("GOOGLE_APPLICATION_CREDENTIALS");
            var credential = GoogleCredential.FromFile(credentialsPath);


            var x = new TranslationServiceClientBuilder() { 
            Credential=credential,
            
            };
            x.Build();
            
            _translationClient = TranslationServiceClient.Create();

This is the underlying code:

public static TranslationServiceClient Create() => new TranslationServiceClientBuilder().Build();

        /// <summary>
        /// Creates a <see cref="TranslationServiceClient"/> which uses the specified call invoker for remote
        /// operations.
        /// </summary>
        /// <param name="callInvoker">
        /// The <see cref="grpccore::CallInvoker"/> for remote operations. Must not be null.
        /// </param>
        /// <param name="settings">Optional <see cref="TranslationServiceSettings"/>.</param>
        /// <param name="logger">Optional <see cref="mel::ILogger"/>.</param>
        /// <returns>The created <see cref="TranslationServiceClient"/>.</returns>
        internal static TranslationServiceClient Create(grpccore::CallInvoker callInvoker, TranslationServiceSettings settings = null, mel::ILogger logger = null)
        {
            gax::GaxPreconditions.CheckNotNull(callInvoker, nameof(callInvoker));
            grpcinter::Interceptor interceptor = settings?.Interceptor;
            if (interceptor != null)
            {
                callInvoker = grpcinter::CallInvokerExtensions.Intercept(callInvoker, interceptor);
            }
            TranslationService.TranslationServiceClient grpcClient = new TranslationService.TranslationServiceClient(callInvoker);
            return new TranslationServiceClientImpl(grpcClient, settings, logger);
        }

Answer 1

I've had this exact issue and struggled to solve it for days. It seems that other threads that explained how to fix this failed to instruct properly:

In the Google Cloud Console, go to "IAM & Admin" -> "Admin". There, you have a list of "Principals". You will probably observe your email, as the "Owner" Role.

It appears that you need to add your "Service Account" to that list. So, next to the "IAM" textbox at the top, you click on "GRANT ACCESS" and in the list of "New principals" you start typing the email of the service account you are using (it will automatically resolve the rest of the name once you start typing).

In the "Assign roles" box you should type "cloud speech" and it will show you all the relevant options. Make sure you choose the correct permissions for this.