0

When trying to create a sink using the Google Cloud Python3 API Client I get the error:

RetryError: GaxError(Exception occurred in retry method that was not classified as transient, caused by <_Rendezvous of RPC that terminated with (StatusCode.PERMISSION_DENIED, The caller does not have permission)>)

The code I used was this one:

import os
os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = 'path_to_json_secrets.json'

from google.cloud.bigquery.client import Client as bqClient
bqclient = bqClient()
ds = bqclient.dataset('dataset_name')

print(ds.access_grants)
[]

ds.delete()
ds.create()

print(ds.access_grants)
[<AccessGrant: role=WRITER, specialGroup=projectWriters>,
 <AccessGrant: role=OWNER, specialGroup=projectOwners>,
 <AccessGrant: role=OWNER, userByEmail=id_1@id_2.iam.gserviceaccount.com>,
 <AccessGrant: role=READER, specialGroup=projectReaders>]

from google.cloud.logging.client import Client as lClient
lclient = lClient()
dest = 'bigquery.googleapis.com%s' %(ds.path)
sink = lclient.sink('sink_test', filter_='jsonPayload.project=project_name', destination=dest)
sink.create()

Don't quite understand why this is happening. When I use lclient.log_struct() I can see the logs arriving in the Logging console so I do have access to Stackdriver Logging.

Is there any mistake in this setup?

Thanks in advance.

Willian Fuks
  • 11,259
  • 10
  • 50
  • 74

1 Answers1

1

Creating a sink requires different permissions than writing a log entry. By default service accounts are given project Editor (not Owner), which does not have permission to create sinks.

See the list of permissions required in the access control docs.

Make sure the service account you're using has logging.sinks.create permission. The simplest way to do this is to switch the service account from Editor to Owner, but it would be better to add the Logs Editor Role so you just give it the permission it needs.

Bill Prin
  • 2,498
  • 1
  • 20
  • 27