python之Google CloudSQLAdmin之服务帐户没有存储桶所需的权限

我正在编写一个 python 函数，它使用服务帐户凭据调用 Google cloudSQLAdmin api 将数据库导出到存储桶。

服务帐户已被授予项目所有者权限，并且存储桶已为项目所有者设置权限。我们的项目已启用 sqlAdmin api。

Python代码:

from google.oauth2 import service_account 
from googleapiclient.discovery import build 
import googleapiclient 
import json 
 
def main(): 
    SCOPES = ['https://www.googleapis.com/auth/sqlservice.admin', 'https://www.googleapis.com/auth/cloud-platform', 'https://www.googleapis.com/auth/devstorage.full_control'] 
    SERVICE_ACCOUNT_FILE = './creds/service-account-credentials.json' 
    PROJECT = "[REDACTED]" 
    DB_INSTANCE = "[REDACTED]" 
    BUCKET_PATH = "gs://[REDACTED]/[REDACTED].sql" 
    DATABASES = [REDACTED] 
    BODY = { # Database instance export request. 
    "exportContext": { # Database instance export context. # Contains details about the export operation. 
      "kind": "sql#exportContext", # This is always sql#exportContext. 
      "fileType": "SQL", # The file type for the specified uri. 
          # SQL: The file contains SQL statements. 
          # CSV: The file contains CSV data. 
      "uri": BUCKET_PATH, # The path to the file in Google Cloud Storage where the export will be stored. The URI is in the form gs://bucketName/fileName. If the file already exists, the requests succeeds, but the operation fails. If fileType is SQL and the filename ends with .gz, the contents are compressed. 
      "databases": DATABASES, 
    }, 
  } 
 
    credentials = service_account.Credentials.from_service_account_file(SERVICE_ACCOUNT_FILE, scopes=SCOPES) 
    sqladmin = googleapiclient.discovery.build('sqladmin', 'v1beta4', credentials=credentials) 
    response = sqladmin.instances().export(project=PROJECT, instance=DB_INSTANCE, body=BODY).execute() 
    print(json.dumps(response, sort_keys=True, indent=4)) 
 

运行此代码会出现以下错误:

Traceback (most recent call last): 
  File "<string>", line 1, in <module> 
  File "[REDACTED]/main.py", line 47, in hello_pubsub 
    response = sqladmin.instances().export(project=PROJECT, instance=DB_INSTANCE, body=BODY).execute() 
  File "/usr/local/lib/python3.7/site-packages/googleapiclient/_helpers.py", line 130, in positional_wrapper 
    return wrapped(*args, **kwargs) 
  File "/usr/local/lib/python3.7/site-packages/googleapiclient/http.py", line 851, in execute 
    raise HttpError(resp, content, uri=self.uri) 
googleapiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/sql/v1beta4/projects/[REDACTED]/instances/[REDACTED]/export?alt=json returned "The service account does not have the required permissions for the bucket."> 

我已经在 2 个 GCP 项目中尝试过此方法，其中有多个具有不同权限的服务帐户。

相关问题: Access denied for service account (permission issue?) when importing a csv from cloud storage to cloud sql - 此问题是由不正确的权限引起的，这里不应该是这种情况，因为该帐户具有项目所有者权限

请您参考如下方法:

Google Cloud 使用 identity and access management 的系统用于管理资源:IAM。

每个 Cloud SQL 实例都使用相应的具有权限的服务帐户。要查找您的 Cloud SQL 服务帐户名称，请转到:

Console > SQL > Instance Name > Service account

使用此服务帐户名称，您可以 grant access control permission for the bucket ，从以下选项中选择:存储管理员、存储对象管理员、存储对象创建者、存储对象查看器。

遵循最小权限原则，您只需添加:Storage Object Creator，即可导出到Cloud Storage bucket。

Detailed storage access roles descriptions are included in the documentation .