Uh oh!
There was an error while loading. Please reload this page.
fix(storage): fix system test and change scope for iam access token - #47
Conversation
System test throws 'Identity and Access Management (IAM) API has not been used in project before or it is disabled. ' error, so need (IAM) permission for this project. |
| service_account_email = Config.CLIENT._credentials.service_account_email | ||
| name = client.service_account_path("-", service_account_email) | ||
| scope = ["https://www.googleapis.com/auth/devstorage.read_write"] | ||
| scope = ["https://www.googleapis.com/auth/cloud-platform"] |
There was a problem hiding this comment.
(we don't have to block merging on this as it is a test, but if this is needed it seems like a large scope for narrow use?)
There was a problem hiding this comment.
FWIW, I can confirm that both tests fail on master with a 403 without this patch.
Update: it fails even with the cloud-platform scope for me on master.
There was a problem hiding this comment.
Could you narrow the scope down to: https://www.googleapis.com/auth/iam
Documented at the bottom of the following document: https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob
There was a problem hiding this comment.
To clarify, you can do join both:
scope = ['https://www.googleapis.com/auth/devstorage.read_write', 'https://www.googleapis.com/auth/iam']
Uh oh!
There was an error while loading. Please reload this page.
…oogleapis#47) * fix(storage): change scope for iam access token * fix: narrow scope * fix: trailing commas * chore: blacken Co-authored-by: Christopher Wilcox <crwilcox@google.com>
…oogleapis#47) * fix(storage): change scope for iam access token * fix: narrow scope * fix: trailing commas * chore: blacken Co-authored-by: Christopher Wilcox <crwilcox@google.com>
Fixes#46