[AutoML][Vision] caller does not have permission

[StefanoGroenland]

Hi,

I am trying to predict an image to my AutoML Vision Dataset, in the hope that i get the label back.

I keep getting the following error code:

Error :
{ "message": "The caller does not have permission", "code": 7, "status": "PERMISSION_DENIED", "details": [] }

Instance : Google \ ApiCore \ ApiException (7) path: vendor/google/gax/src/ApiException.php:139

Code :

   use Google\Cloud\AutoMl\V1beta1\Image;
   use Google\Cloud\AutoMl\V1beta1\ExamplePayload;
   use Google\Cloud\Vision\V1\ImageAnnotatorClient;
   use Google\Cloud\AutoMl\V1beta1\PredictionServiceClient;

   public function recognize(string $path): Collection
   {
      $image = file_get_contents($path);
      $googleImage = new Image();
      $googleImage->setImageBytes($image);

      $predictor = new PredictionServiceClient();

      $projectId = env('GOOGLE_CLOUD_PROJECT');
      $region = 'us-central1';
      $model = 'MASKED';
      $apiPath = "projects/{$projectId}/locations/{$region}/models/{$model}";

      $payload = new ExamplePayload(['image' => $googleImage]);

      $response = $predictor->predict($apiPath, $payload);
    }

Description
I have one other API Endpoint that i use, the TEXT_DETECTION on OCR Vision API. Which works smoothly.
I have enabled all storage api's and permissions on my serviceaccount but nothing helps. The error is thrown on the last line ->predict()

All help is welcome!

EDIT:
Roles enabled on serviceaccount :

[jdpedrie]

Have you verified that the project ID in ENV[GOOGLE_CLOUD_PROJECT] is correct and matches the service account you are using to make requests?

[StefanoGroenland]

Have you verified that the project ID in ENV[GOOGLE_CLOUD_PROJECT] is correct and matches the service account you are using to make requests?

Yes, and it does!

[StefanoGroenland]

I have also enabled all these Roles on my service account. Which should be overkill. But they contain the correct permissions according to the docs.

[jdpedrie]

Reading through the "Before You Begin" guide, they specifically ask that you grant yourself both roles/automl.admin (which you have), and roles/automl.editor. It seems that if the former encompassed the latter, they would not have asked for both to be granted. Try adding that role and seeing if it works.

Additionally, review all the other information on that page and be sure you've correctly configured everything.

[StefanoGroenland]

@jdpedrie I enabled the permissions accordingly to what they stated on the link you provided

(accounts top => bottom : Account for Console UI, AutoML Service agent (google auto-created) and my own service account i use in my application via json file)

The serviceaccount i use for the API is set up properly to be used (Vision API works). Since i changed the permissions around it didn't have any effect on the AutoML API.

[StefanoGroenland]

@jdpedrie thanks for the help. I just figured out that somehow my service account almost got duplicated. With one or two characters different. And i was using the wrong one in the IAM interface..