Anonymous caller does not have storage.objects.get

Question

On Google App Engine (GAE) written in Python.

I am trying to issue an http post to cloud-speech-to-text api and using URI audio source (Google Cloud Storage Bucket Objects).

I am using the following headers;

Authorization: BASIC encoded_base64(username:password)

But I still keep getting an error response below:

{ "error": { "code": 403, "message": "Anonymous caller does not have storage.objects.get access to bucket_of_secrets/four_score_seven_years.flac.", "status": "PERMISSION_DENIED" } }

So I have a couple of questions;

1. Does BASIC Authorization Header work in Google HTTP API?
2. What username:password should I use? Is it my GCP account email and password? i.e. [email protected]:deluded_fool

Where [email protected] is the username and deluded_fool is the password.

I've tried setting the bucket objects to be public readable and of course the http call works... but I would rather avoid setting my bucket objects public readable.

Here's a sample Curl request:

curl -X POST 

https://speech.googleapis.com/v1/speech:longrunningrecognize?key=<secret_api_key> -d @sample.json -H "Content-Type: application/json, Authorization:  Basic base64encodedusername:password" 

Here's a snippet in my python code using urlfetch:

url_post = urlfetch.fetch(url=speech_to_text_url_post, payload=json.dumps(data_to_post), method=urlfetch.POST, headers={"Content-Type" : "application/json", "Authorization" : "Basic "+encoded_user_password})

Answer 1

1.Does BASIC Authorization Header work in Google HTTP API?

No, It is not working on Google APIs. You need to attach OAuth2.0 accessToken to Authorization Header as bearer token like Authorization: Bearer ${yourAccessToken}.

I have 2 recommendations to develop some application running on gae.

1. Use ClientLibrary to call Google APIs.
2. You can use AppEngineDefaultCredential to call Google APIs. Do not forget to set permissions to your AppEngineDefaultServiceAccount (${projectId}@appspot.gserviceaccount.com) before issue your request. You can configure those permissions on IAM page in cloud console.

Also I recommend you to read this page about How to authenticate your api call.

Answer 2

If you want to grant public access, you can make data public.

https://cloud.google.com/storage/docs/access-control/making-data-public

But the best way is generate Signed Urls, this way you can grant limit time access to an object.

https://cloud.google.com/storage/docs/access-control/signed-urls

Answer 3

For me, the issue was using role "Storage Legacy Object Reader", that, for whatever reason, was suggested. Changing it to "Storage Object Viewer" solved the issue.