Question

A Compute Engine instance runs an application that must read objects from a Cloud Storage bucket. The instance uses the default Compute Engine service account, which already has the 'Storage Object Viewer' IAM role granted at the project level. However, the application receives a 403 permission error when calling the Cloud Storage API. You confirm the IAM binding is correct. What is the most likely cause and how should you fix it without recreating the instance?

Accepted Answer

The instance's access scopes do not include storage access; stop the VM and update the access scopes to allow Cloud Storage.

Answer

The service account key has expired; generate a new service-account key and place it on the instance.

Answer

The IAM role must be granted at the bucket level instead of the project level; re-grant it directly on the bucket.

Answer

The Cloud Storage API is disabled in the project; enable the API and the call will succeed immediately.