1

When I write an object to GCS via the JSON API and then try to call getServingUrl() I get an ACCESS_DENIED error. My App Engine app can read/write the GCS object no problem, but when it calls getServingUrl() it won't work unless I grant OWNER to allUsers. If I even grant READER to allUsers it still generates ACCESS_DENIED.

I am assuming that getServingUrl() needs to read the meta data so therefore it needs OWNER on an object. So the question is, what entity do i grant OWNER to for getServingUrl() to work?

Here is the relevant code:

StorageObject metadata = new StorageObject()
    .setMetadata( ImmutableMap.of(ExtendedMetaDataOriginalFile, originalFilename) )
    .setContentType(contentType);

this.storage.objects().copy(bucketName, objectName + ".chunk0", bucketName, objectName, metadata).execute();

// without this line the getServingURL generates an ACCESS_DENIED   
this.storage.objectAccessControls().insert(bucketName, objectName, 
                    new ObjectAccessControl().setEntity("allUsers").setRole("OWNER") 
                    ).execute();

    ServingUrlOptions options = ServingUrlOptions.Builder.withGoogleStorageFileName("/gs/"+bucketName+"/"+objectName).secureUrl(true);

    String imageServingURL = ImagesServiceFactory.getImagesService().getServingUrl(options); // throws an exception with ACCESS_DENIED unless i set allUsers to OWNER
1
  • I've now tried every entity I can think of - only allUsers and allAuthenticatedUsers work. I can, however, grant OWNER to allAuthenticatedUsers, get the serving url, then revoke that permission. It still seems to work... so permissions needed for generating the serving url, but not serving it (at least so far in my testing). Dec 23, 2014 at 18:06

2 Answers 2

1

Setting permissions on the Object, not the bucket, as follows, solves the problem with getServingUrl():

 storage.objectAccessControls().insert(bucketName, objectName, 
      new ObjectAccessControl().setEntity("[email protected]")
      .setRole("OWNER") ).execute();
0

It sounds like your app engine app may not have full control of the bucket or the objects in the bucket. Try changing the default object ACL on the bucket being used that gives your app FULL_CONTROL permissions, as well as giving your app FULL_CONTROL on the bucket ACL.

8
  • Can you provide a snippet of what that might look like? Dec 23, 2014 at 23:25
  • The buckets are created with a service account via JSON API, the permissions on the bucket are as follows: Project owners-463613709343 OWNER / Project editors-463613709343 OWNER / Project viewers-463613709343 READER ---- so what additional permissions are needed for the app to call getServingURL?? Dec 23, 2014 at 23:31
  • 1
    Is the service account that the app engine app runs as the same service account that is creating the bucket? In other words, is [email protected] one of the owners of project 463613709343? Dec 24, 2014 at 0:55
  • service account creqating buckets: 463613709343-qaggc8vl386h18a55pkuh9trjqkja0dc@developer.gserviceaccount.com THIS is listed as "email address" under "App Engine and Compute Engine": [email protected] Dec 24, 2014 at 1:37
  • I don't see any service account listed as [email protected] -- nothing containing appspot.gserviceaccount.com Dec 24, 2014 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.