Permission error with newest version: 'iam.serviceAccounts.signBlob' denied on resource

[hendrik244]

Hi,

just updated to the latest version of strapi and this plugin. All services are hosted in gcp. After updating I received this error, when trying to fetch content with images (stored in gcs) included:

After rolling it back to the former used version (4.5.6) it all runs fine again. Even with the latest strapi version.

Best regards, Hendrik

[tjablonski]

I have same issue with 4.10.2

[marcneander]

Same here

[hendrik244]

This helped me out: https://stackoverflow.com/questions/75071759/google-cloud-storage-permission-denied

Maybe not the plugin, but gcp is the problem...

[knokmki612]

Maybe not the plugin, but gcp is the problem...

I think it also relates to release version of 4.10.1 https://github.com/strapi-community/strapi-provider-upload-google-cloud-storage/releases/tag/4.10.1

Because this release supports gcs signed url https://cloud.google.com/storage/docs/access-control/signed-urls#signing-iam

If my guess is correct, enable publicFiles options will be change the situation (If you don't want to use ~~expires option~~ signed url).

[LaurenceHo]

Is that possible we don't use signed url on public files? or maybe we can config whether we want to use signed URL or not?

[benaduggan]

This helped me out: stackoverflow.com/questions/75071759/google-cloud-storage-permission-denied

Maybe not the plugin, but gcp is the problem...

This also helped fix things for me! Specifically adding the "Service Account Token Creator" role to our service account. Also just wanted to show off my config block in case it helps anyone else!

[knokmki612]

Is that possible we don't use signed url on public files?

Yes that's possible. if you set true to publicFiles option, you can get unsigned url. This behavior documented as follows:

Files are signed when publicFiles is set to false.

https://github.com/strapi-community/strapi-provider-upload-google-cloud-storage#expires

or maybe we can config whether we want to use signed URL or not?

We can choose to use signed URL or not by publicFiles option.

[Fryuni]

This should just be documented on the new version, but it is not something that this plugin can change.

The new version of the @google-cloud/storage library uses the new signature method to sign the upload (and preview) URLs. The new method requires a different IAM permission, not on the bucket but on the service account itself.

You either have to use a key file, which allows signing the blobs locally, or grant the role "Service Account Token Creator" (role/iam.serviceAccountTokenCreator) to the service account on the service account itself. This is in addition to the roles required to manage the files in the bucket, those were already required and still are.