用于存储的 GCP 服务帐户无法正常工作

Question

我在 GCP Console 中创建了服务帐户 IAM 和管理员 > 服务帐户 >> 创建

分配的存储管理员、存储对象管理员、存储对象创建者

创建密钥并下载json文件

为了测试这个服务帐号，我在 GCP VM 上运行了这个命令

$ gcloud auth activate-service-account --key-file service-account.json 
Activated service account credentials for: [ingester@xxx-123.iam.gserviceaccount.com]

然后我可以将文件cp到存储桶

$ gsutil cp image-src.txt gs://bucket-images
Copying file://image-src.txt [Content-Type=text/plain]...
/ [1 files][ 19.5 KiB/ 19.5 KiB]                                                
Operation completed over 1 objects/19.5 KiB.

但是当我尝试将 service-account.json 与 node.js 应用程序一起使用时，我得到了

(node:1) UnhandledPromiseRejectionWarning: Error: ingester@xxx-123.iam.gserviceaccount.com does not have storage.objects.create access to the Google Cloud Storage object.
    at new ApiError (/ingester/node_modules/@google-cloud/common/build/src/util.js:59:15)
    at Util.parseHttpRespBody (/ingester/node_modules/@google-cloud/common/build/src/util.js:194:38)
    at Util.handleResp (/ingester/node_modules/@google-cloud/common/build/src/util.js:135:117)
    at retryRequest (/ingester/node_modules/@google-cloud/common/build/src/util.js:434:22)
    at onResponse (/ingester/node_modules/retry-request/index.js:206:7)
    at /ingester/node_modules/teeny-request/build/src/index.js:170:17
    at process._tickCallback (internal/process/next_tick.js:68:7)
(node:1) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 5)

我是否正确创建了服务帐户？

更新：v1gnus 回答后

我试图得到

cloudshell:~ $ gcloud iam service-accounts get-iam-policy ingester@xxx-123.iam.gserviceaccount.com
etag: ACAB

然后我尝试设置策略

cloudshell:~ $ gcloud projects add-iam-policy-binding xxx-123 --member serviceAccount:ingester@xxx-123.ia
m.gserviceaccount.com --role roles/storage.admin
    Updated IAM policy for project [xxx-123].
    bindings:
    ...
    - members:
      - serviceAccount:ingester@xxx-123.iam.gserviceaccount.com
      role: roles/storage.admin
    - members:
      - serviceAccount:ingester@xxx-123.iam.gserviceaccount.com
      role: roles/storage.objectAdmin
    - members:
      - serviceAccount:ingester@xxx-123.iam.gserviceaccount.com
      role: roles/storage.objectCreator
    etag: rfvtgyh-4Gw=
    version: 1

在这之后我仍然得到这个

cloudshell:~ $ gcloud iam service-accounts get-iam-policy ingester@xxx-123.iam.gserviceaccount.com
etag: ACAB

Answer 1

您的服务帐户的权限似乎有问题

“Error: ingester@xxx-123.iam.gserviceaccount.com does not have storage.objects.create access to the Google Cloud Storage object.”

您可以通过输入 command 来查看已为您的服务帐户分配的角色：

gcloud iam service-accounts get-iam-policy ingester@xxx-123.iam.gserviceaccount.com

有关如何使用 Google Cloud Storage Node.js 客户端 API 的更多信息，请查看link