Permissions problem trying to create a sink

[tseaver]

While working on a system test for Sink.create, I'm running into a permissions problem:

>>> sink.create()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "gcloud/logging/sink.py", line 145, in create
    client.connection.api_request(method='PUT', path=self.path, data=data)
  File "gcloud/connection.py", line 343, in api_request
    error_info=method + ' ' + url)
gcloud.exceptions.Forbidden: 403 The caller does not have permission (PUT https://logging.googleapis.com/v2beta1/projects/citric-celerity-697/sinks/test-sink)

Sinks.create is documented to require one of https://www.googleapis.com/auth/logging.admin or https://www.googleapis.com/auth/cloud-platform.

My client is set up with all permissions for the logging API:

>>> client.connection._credentials._scopes
'https://www.googleapis.com/auth/logging.read https://www.googleapis.com/auth/logging.write https://www.googleapis.com/auth/logging.admin https://www.googleapis.com/auth/cloud-platform'

Do I have to do something in the developer control panel to enable sinks?

[tseaver]

@jgeewax please loop in whoever would be able to point me in the right direction from the logging API team.

[tseaver]

Maybe germane: https://cloud.google.com/logging/docs/export/configure_export#exported-logs-permissions

[tseaver]

More likely an error on my part: the failed request was trying to do a PUT to the URL of the sink, which doesn't yet exist, instead of a POST to the /sinks quasi-container.

[tseaver]

But I'm betting that when I do get that part right, then the 403 will trigger because I don't have the bucket permissions set correctly.

[tseaver]

Grrr. Switching to POST doesn't fix it:

gcloud.exceptions.Forbidden: 403 The caller does not have permission (POST https://logging.googleapis.com/v2beta1/projects/citric-celerity-697/sinks)

That same URI works fine in the API Exploder.

[dhermes]

@jgeewax Any ideas?

[dhermes]

@callmehiphop @stephenplusplus @blowmage have you run into this?

[stephenplusplus]

Yes! Check this out: googleapis/google-cloud-node#1156

[stephenplusplus]

Related Ruby issue: googleapis/google-cloud-ruby#569

[blowmage]

IIRC the Pub/Sub IAM issue is different. The issue with creating Logging Sinks is that it requires a user account, not a service account. This is imposed by the API, and there isn't much we can do to get around it. @quartzmo, does that sound right?

[stephenplusplus]

Ah, my bad. We were getting errors creating Sinks with a Pub/Sub Topic as a destination, which traces back to the Pub/Sub IAM change, so I jumped at a connection between that issue and this one.

Indeed, you must be authenticated as a user (through the gcloud SDK works). Here's the official word from a Logging member: googleapis/google-cloud-node#842 (comment)

[blowmage]

There are some additional steps for creating a sink to a Bucket, and @quartzmo was chasing that info down for our docs, so I'll defer to him on that as well. 😅