gsutil results in "CommandException: You have multiple types of configured credentials"

Question

I'm trying to run a gsutil command to list the contents within a bucket on Google Cloud Storage. I'm almost certain there's nothing wrong with the command.

The error I'm getting is:

CommandException: You have multiple types of configured credentials (['Oauth 2.0 User Account', 'OAuth 2.0 Service Account']), which is not supported. For more help, see "gsutil help creds".

I've read the details in "gsutil help creds", but that just contains high-level definitions on the four credential types, which isn't helpful.

Reading the error message, it would seem like I basically need to remove one of the "configured credentials", and in this case I want to remove the "Oauth 2.0 User Account" credentials. And use the "OAuth 2.0 Service Account".

Thus I've looked inside the ".boto" file containing my automatically generated config credentials, but it doesn't look like there's an Oauth 2.0 User Account that can be edited.

I've also tried digging throughout Google's Developer Console to remove the Oauth 2.0 User Account, but I'm unable to.

Basically, my question (assuming it's the right question), how do I remove "Oauth 2.0 User Account" credentials in the Google Cloud Platform?

Answer 1

Please run:

gsutil -D

The debug output will include config_file_list, which should show you where the multiple credentials are defined.

Are you running from Google Compute Engine? A common way this problem happens is when users configure credentials for gsutil (using gsutil config) in ~/.boto when GCE already has created service account credentials (in /etc/boto.cfg)

Answer 2

Did you try to run gcloud auth ?

Usage: gcloud auth [optional flags] <command>
  command may be         activate-refresh-token | activate-service-account |
                         list | login | revoke

Manage oauth2 credentials for the Google Cloud SDK.

optional flags:
  --format FORMAT        Format for printed output.
  --help                 Display detailed help.
  --project PROJECT      Google Cloud Platform project to use for this
                         invocation.
  --quiet, -q            Disable all interactive prompts.
  -h                     Print a summary help and exit.

commands:
  activate-refresh-token
                         Get credentials via an existing refresh token.
  activate-service-account
                         Get credentials via the private key for a service
                         account.
  list                   List the accounts for known credentials.
  login                  Get credentials for the tools in the Google Cloud SDK
                         via a web flow.
  revoke                 Revoke authorization for credentials.