In learning how to use Google Compute Engine with Google Cloud Storage, I've run into a problem with ACLs. From my own computer, using my own SSH credentials, I can do whatever I want with my bucket. But when I log into my compute instance using the web-based SSH client, I can only read from the bucket. Copying data back up to the bucket get's me a 'AccessDeniedException: 403 Insufficient Permission' error. (I'm doing all of these copying experiments with gsutil.)
This makes no sense to me. The one and only service account has project editor role granted, and I confirmed that the bucket ACL list gives owner access to both the project editor role AND to the service account. I also tried changing the service account to have "WRITE" permission instead of "OWNER" on the bucket but that doesn't help. Finally, I'm using the downloaded ssh keys for the same default service account when doing all of this from my local machine, so I don't understand why it is changing.
Part of the problem is that I can't see where the rubber meets the road--all I get is a 403 with no more information. I can't see what gsutil is doing (in fact, I'm not even sure how gsutil obtains its credentials, since that is all done automatically when you ssh in via console--I'm just assuming it's logging under the service account).
I'd obviously like to fix this immediate problem, but I'd also appreciate any tips as to how to debug these issues as they come up in the future.