Google Api - Access is denied from c#, works with python

Question

Facing an access problem using the google Api NuGet: Using google v3 Environment.SetEnvironmentVariable("GOOGLE_APPLICATION_CREDENTIALS", _googleApiParams.CredentialsPath /path to JSON file/); _translationClient = TranslationServiceClient.Create();

            DetectLanguageRequest request = new()
            {
                Parent = "projects/my-project-name",
                Content = "this is a detection test"
            };

My Error: the exception:

Grpc.Core.RpcException: 'Status(StatusCode="PermissionDenied", Detail="Cloud IAM permission 'cloudtranslate.languageDetectionModels.predict' denied. ")

This python code works howerver:

self.translate_client = translate.Client.from_service_account_json(self.google_api_credentials_json_path)
                translated_text = self.translate_client.translate(values="this is a test", target_language=target_language,

Any Ideas for a fix?

Edit: Tried a dif approach, still the same error, same credentials work with python

 var credentialsPath = Environment.GetEnvironmentVariable("GOOGLE_APPLICATION_CREDENTIALS");
            var credential = GoogleCredential.FromFile(credentialsPath);


            var x = new TranslationServiceClientBuilder() { 
            Credential=credential,
            
            };
            x.Build();
            
            _translationClient = TranslationServiceClient.Create();

This is the underlying code:

public static TranslationServiceClient Create() => new TranslationServiceClientBuilder().Build();

        /// <summary>
        /// Creates a <see cref="TranslationServiceClient"/> which uses the specified call invoker for remote
        /// operations.
        /// </summary>
        /// <param name="callInvoker">
        /// The <see cref="grpccore::CallInvoker"/> for remote operations. Must not be null.
        /// </param>
        /// <param name="settings">Optional <see cref="TranslationServiceSettings"/>.</param>
        /// <param name="logger">Optional <see cref="mel::ILogger"/>.</param>
        /// <returns>The created <see cref="TranslationServiceClient"/>.</returns>
        internal static TranslationServiceClient Create(grpccore::CallInvoker callInvoker, TranslationServiceSettings settings = null, mel::ILogger logger = null)
        {
            gax::GaxPreconditions.CheckNotNull(callInvoker, nameof(callInvoker));
            grpcinter::Interceptor interceptor = settings?.Interceptor;
            if (interceptor != null)
            {
                callInvoker = grpcinter::CallInvokerExtensions.Intercept(callInvoker, interceptor);
            }
            TranslationService.TranslationServiceClient grpcClient = new TranslationService.TranslationServiceClient(callInvoker);
            return new TranslationServiceClientImpl(grpcClient, settings, logger);
        }

What is the value of the `GOOGLE_APPLICATION_CREDENTIALS` environment variable at runtime? And how are you setting it? Is this code running in GCP or locally? — Matt Welke, Apr 06 '23 at 03:27
"This is the underlying code:" Usually when posting Stack Overflow questions like this, you don't need to share code from the 3rd party dependencies you're using, especially if they're from big, reputable companies like Google. The problem is usually with your own code. And even when it's not, and the problem is with the library, the best way to diagnose the problem with the library is to use it according to its public API (instead of looking at its source code). — Matt Welke, Apr 06 '23 at 03:32
Also, it would be helpful to know the exact name of the NuGet package and the version you're using, that way we could help you create a minimal reproduction of the issue (which I suspect would be a basic .NET console application where you just call `TranslationServiceClient.Create`). — Matt Welke, Apr 06 '23 at 03:35

score 0 · Accepted Answer · answered Apr 06 '23 at 14:13

I've had this exact issue and struggled to solve it for days. It seems that other threads that explained how to fix this failed to instruct properly:

In the Google Cloud Console, go to "IAM & Admin" -> "Admin". There, you have a list of "Principals". You will probably observe your email, as the "Owner" Role.

It appears that you need to add your "Service Account" to that list. So, next to the "IAM" textbox at the top, you click on "GRANT ACCESS" and in the list of "New principals" you start typing the email of the service account you are using (it will automatically resolve the rest of the name once you start typing).

In the "Assign roles" box you should type "cloud speech" and it will show you all the relevant options. Make sure you choose the correct permissions for this.

Google Api - Access is denied from c#, works with python

1 Answers1