"serviceusage.services.use" Permission denied. about google-cloud-php HOT 9 CLOSED

Hi @lope7 ,

This means you're missing the serviceusage.service.use IAM permission on your credential. Can you please post a reproduction script where I can try to confirm this issue?

from google-cloud-php.

Hi @yash30201,
Thank you very much for your response.
We know that it asks for that permission and we don't have it, but we want to know the reason why that permission is requested to do an "exists()" when it should not be necessary since we have been able to do other writing methods and it does not ask for this permission.
I understand that the solution is to activate that permission, but this doesn't make sense, right?

from google-cloud-php.

Yes this seems strange. That's why I wanted you to post a script where you're experiencing to troubleshoot this further.

from google-cloud-php.

`<?php

use Google\Cloud\Storage\StorageClient;

$storageClient = new StorageClient([
"projectId" => 'xxx',
"apiEndpoint" => 'xxx'
]);
$nameImage = 'image.jpg';
$bucket = $storageClient->bucket($this->bucketName, true);
$object = $bucket->object($nameImage);
try {
$object->exists();
} catch (Throwable $e) {
die("Our problem is here " . $e->getMessage());
}`

from google-cloud-php.

Can you tell me how do you authenticate in the library? (Service Account, gcloud auth login, Impersonated Service Account, External Account Credentials . . . )

from google-cloud-php.

Hi @yash30201 , I'm Lope's teammate. He is on vacaction. We use Service Account to authenticate.

from google-cloud-php.

Hey @glesende , I ran the following script which you provided with a Service Account which only has the Storage Admin permission. I didn't face any issue.

<?php

use Google\Cloud\Storage\StorageClient;

require_once __DIR__ . '/../vendor/autoload.php';

$storage = new StorageClient([
    'projectId' => getenv('GOOGLE_PROJECT_ID'),
    'keyFilePath' => getenv('GOOGLE_CLOUD_STORAGE_SA')
]);

$bucket = $storage->bucket('testing-bucket');
$object = $bucket->object('test.image');
try {
    $object->exists();
} catch (Throwable $e) {
    die("Our problem is here " . $e->getMessage());
}

So this rules out the fact that $object->exists() requires an extra IAM permission.

I think the issue is that your service account which the library is picking doesn't has the proper permissions to access the project which you're trying to bill the api calls.

from google-cloud-php.

Than you, we will check this with our SRE team.

from google-cloud-php.

Hey @glesende , thanks for opening this issue.

I'm closing this for now. Please reopen if it still persists and you're sure it's coming from this library.

from google-cloud-php.