gsutil AccessDeniedException: 401 Login Required

问题

So I run the following:

gsutil -m cp -R file.png gs://bucket/file.png

And I get the following error message:

Copying file://file.png [Content-Type=application/pdf]...
Uploading   file.png: 42.59 KiB/42.59 KiB    
AccessDeniedException: 401 Login Required
CommandException: 1 files/objects could not be transferred.

I'm not sure what the problem is since I ran config and I can see all my buckets. Does anyone know what I need to do?

Note: I do not have gcloud, I just installed gsutil and ran the config.

回答1:

Login to Google Cloud is needed for accessing any Cloud service. You need to use below command which will guide you through login steps like typing verification code you generate by opening browser link given in console.

gcloud auth login

回答2:

I was getting a similar response, and was able to solve this problem by looking at the read permissions on the .boto file. In my case, I was using a service account and the .boto file that was created by

gsutil config -e

only had read permissions set for user. Since it was being read by a service running as a different user, it wasn't able to read the file and yielding a 401 Login Required error. I fixed it by adding read permissions for the service's group.

In the least sophisticated case, you could fix it by giving any user read permission with

chmod a+r .boto

A more detailed explanation for troubleshooting

To get more information, run the same command with a -D flag, like:

gsutil -m -D cp ....

In the debug output, look at:

Command being run: /path/to/gsutil
config_file_list: /path/to/boto/config

Create your login credentials using the executable at /path/to/gsutil, not gcloud auth or any other gsutil executable on the machine, using:

/path/to/gsutil config

For a service account, use:

/path/to/gsutil config -e

These should create a .boto config file in your home directory, $HOME/.boto. If you are running the gsutil command this file should be referenced in the config_file_list variable in the debug output. If not, see below to change it.

Running gsutil under a service account or as another user

If you are running as another user, and need to reference a newly-created config file, set the environment variable BOTO_CONFIG (don't forget to export it):

BOTO_CONFIG=/path/to/$HOME/.boto
export BOTO_CONFIG

By setting this variable, when you execute gsutil, it will reference the config file you have placed in BOTO_CONFIG. You can confirm that you are referencing the correct config file by looking at the config_file_list variable in the gsutil -D command's output.

make sure the referenced .boto file is readable by the user who is executing the gsutil command

Running the /path/to/gsutil with the BOTO_CONFIG variable set allowed me to execute gsutil as another user, referencing an arbitrary BOTO_CONFIG file that was set up with a service-account's credentials.

To set up the service account:

https://console.cloud.google.com/permissions/serviceaccounts

The key file from the service account set-up process needs to be downloaded, and the path to it is requested during the gsutil config -e step.

回答3:

This may be an issue with how gsutil/boto handles the OS path separators on Windows, as referenced here. This should eventually get merged into the sdk tools, but until then the following should work:

Go to
google-cloud-sdk\platform\gsutil\third_party\boto\boto\pyami\config.py

and replace the line:

for path in os.environ['BOTO_PATH'].split(':'):

with:

for path in os.environ['BOTO_PATH'].split(os.path.pathsep):

Next, go to google-cloud-sdk\bin\bootstrapping\gsutil.py

replace the lines that use ':'

if boto_config:
      boto_path = ':'.join([boto_config, gsutil_path])
    elif boto_path:
      # this is ':' for windows as well, hardcoded into the boto source.
      boto_path = ':'.join([boto_path, gsutil_path])
    else:
      path_parts = ['/etc/boto.cfg',
                    os.path.expanduser(os.path.join('~', '.boto')),
                    gsutil_path]
      boto_path = ':'.join(path_parts)

with

if boto_config:
      boto_path = os.path.pathsep.join([boto_config, gsutil_path])
    elif boto_path:
      # this is ':' for windows as well, hardcoded into the boto source.
      boto_path = os.path.pathsep.join([boto_path, gsutil_path])
    else:
      path_parts = ['/etc/boto.cfg',
                    os.path.expanduser(os.path.join('~', '.boto')),
                    gsutil_path]
      boto_path = os.path.pathsep.join(path_parts)

Restart cmd and now the error should go away.

来源：https://stackoverflow.com/questions/28518706/gsutil-accessdeniedexception-401-login-required

标签

google-cloud-storage

gsutil