getApplicationDefault not taking the IAM account from meta server in GCP #2291
Description
package:
"com.google.api-client" % "google-api-client" % "2.0.0"
"com.google.apis" % "google-api-services-sheets" % "v4-rev20220927-2.0.0"
Mine is a scala application running as K8S pod in GCP. inside the pod, I can call the curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/" -H "Metadata-Flavor: Google" url and i can get the IAM account which have the required permission to write to google sheet api.
i am using below code snippet
import com.google.api.client.googleapis.auth.oauth2.GoogleCredential
import com.google.api.client.json.gson.GsonFactory
import com.google.api.client.auth.oauth2.Credential
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport
import com.google.api.services.sheets.v4.model._
import com.google.api.services.sheets.v4.{Sheets, SheetsScopes}
private val credentials = GoogleCredential.getApplicationDefault
.createDelegated("sample@sampl.com")
.createScoped(util.Arrays.asList(SheetsScopes.SPREADSHEETS))
logger.info(
s"print ${credentials.getServiceAccountScopesAsString} ${credentials.getServiceAccountUser} ${credentials.getServiceAccountProjectId}"
)
print statement returns null values for all the methods called. This works fine with setting GOOGLE_APPLICATION_CREDENTIALS env with json file of the IAM account. but does not work with IAM credentials from meta server. always getting below error
com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 Forbidden
POST https://sheets.googleapis.com/v4/spreadsheets
{
"code": 403,
"details": [
{
"@type": "type.googleapis.com/google.rpc.ErrorInfo",
"reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT"
}
],
"errors": [
{
"domain": "global",
"message": "Insufficient Permission",
"reason": "insufficientPermissions"
}
],
"message": "Request had insufficient authentication scopes.",
"status": "PERMISSION_DENIED"
}
at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:146)
at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:118)
at