embulk+digdagを使ってGCSからBigQueryへデータ取り込みを行いたい

Question

概要

embulk+digdagを使ってGCSからBigQueryへデータ取り込みを行いたいのですが，
実行時にgcs bucketにアクセスできないというエラーが発生します．

このエラーの解決方法が権限周りということは分かりますが，セットアップした環境は問題ないように思います．
何が問題でしょうか．

詳細

コマンド：
embulk run XXXX.yaml

XXXX.yaml：

in:
  type: gcs
  bucket: <bucket name>
  path_prefix: <file path>
  auth_method: compute_engine
  parser:
    type: poi_excel
    sheets: <sheet name>
    skip_header_lines: 4
    columns:
    - {name: 'name', type: string}
        .
        .
        .
out:
  type: bigquery
  mode: replace
  project: <project name>
  dataset: <dataset name>
  table: <table name>
  auth_method: compute_engine
  schema_file: <file name of json type>
  gcs_bucket: <gcs tmp bucket name>

output：

$ embulk run XXXX.yaml
2020-07-22 14:27:36.559 +0900: Embulk v0.9.23
2020-07-22 14:27:37.609 +0900 [WARN] (main): DEPRECATION: JRuby org.jruby.embed.ScriptingContainer is directly injected.
2020-07-22 14:27:40.577 +0900 [INFO] (main): Gem's home and path are set by default: "/Users/oniki/.embulk/lib/gems"
2020-07-22 14:27:41.662 +0900 [INFO] (main): Started Embulk v0.9.23
2020-07-22 14:27:41.853 +0900 [INFO] (0001:transaction): Loaded plugin embulk-input-gcs (0.3.2)
2020-07-22 14:27:46.263 +0900 [INFO] (0001:transaction): Loaded plugin embulk-output-bigquery (0.6.4)
2020-07-22 14:27:46.369 +0900 [INFO] (0001:transaction): Loaded plugin embulk-parser-poi_excel (0.1.7)
org.embulk.exec.PartialExecutionException: org.embulk.config.ConfigException: com.google.cloud.storage.StorageException: Anonymous caller does not have storage.objects.list access to the Google Cloud Storage bucket.
    at org.embulk.exec.BulkLoader$LoaderState.buildPartialExecuteException(BulkLoader.java:340)
    at org.embulk.exec.BulkLoader.doRun(BulkLoader.java:566)
    at org.embulk.exec.BulkLoader.access$000(BulkLoader.java:35)
    at org.embulk.exec.BulkLoader$1.run(BulkLoader.java:353)
    at org.embulk.exec.BulkLoader$1.run(BulkLoader.java:350)
    at org.embulk.spi.Exec.doWith(Exec.java:22)
    at org.embulk.exec.BulkLoader.run(BulkLoader.java:350)
    at org.embulk.EmbulkEmbed.run(EmbulkEmbed.java:242)
    at org.embulk.EmbulkRunner.runInternal(EmbulkRunner.java:291)
    at org.embulk.EmbulkRunner.run(EmbulkRunner.java:155)
    at org.embulk.cli.EmbulkRun.runSubcommand(EmbulkRun.java:431)
    at org.embulk.cli.EmbulkRun.run(EmbulkRun.java:90)
    at org.embulk.cli.Main.main(Main.java:64)
    Suppressed: java.lang.NullPointerException
        at org.embulk.exec.BulkLoader.doCleanup(BulkLoader.java:463)
        at org.embulk.exec.BulkLoader$3.run(BulkLoader.java:397)
        at org.embulk.exec.BulkLoader$3.run(BulkLoader.java:394)
        at org.embulk.spi.Exec.doWith(Exec.java:22)
        at org.embulk.exec.BulkLoader.cleanup(BulkLoader.java:394)
        at org.embulk.EmbulkEmbed.run(EmbulkEmbed.java:245)
        ... 5 more
Caused by: org.embulk.config.ConfigException: com.google.cloud.storage.StorageException: Anonymous caller does not have storage.objects.list access to the Google Cloud Storage bucket.
    at org.embulk.input.gcs.AuthUtils.newClient(AuthUtils.java:81)
    at org.embulk.input.gcs.GcsFileInput.listFiles(GcsFileInput.java:49)
    at org.embulk.input.gcs.GcsFileInputPlugin.transaction(GcsFileInputPlugin.java:59)
    at org.embulk.spi.FileInputRunner.transaction(FileInputRunner.java:62)
    at org.embulk.exec.BulkLoader.doRun(BulkLoader.java:507)
    ... 11 more
Caused by: com.google.cloud.storage.StorageException: Anonymous caller does not have storage.objects.list access to the Google Cloud Storage bucket.
    at com.google.cloud.storage.spi.v1.HttpStorageRpc.translate(HttpStorageRpc.java:226)
    at com.google.cloud.storage.spi.v1.HttpStorageRpc.list(HttpStorageRpc.java:366)
    at com.google.cloud.storage.StorageImpl$8.call(StorageImpl.java:338)
    at com.google.cloud.storage.StorageImpl$8.call(StorageImpl.java:335)
    at com.google.api.gax.retrying.DirectRetryingExecutor.submit(DirectRetryingExecutor.java:105)
    at com.google.cloud.RetryHelper.run(RetryHelper.java:76)
    at com.google.cloud.RetryHelper.runWithRetries(RetryHelper.java:50)
    at com.google.cloud.storage.StorageImpl.listBlobs(StorageImpl.java:334)
    at com.google.cloud.storage.StorageImpl.list(StorageImpl.java:290)
    at org.embulk.input.gcs.AuthUtils.newClient(AuthUtils.java:77)
    ... 15 more
Caused by: com.google.api.client.googleapis.json.GoogleJsonResponseException: 401 Unauthorized
{
  "code" : 401,
  "errors" : [ {
    "domain" : "global",
    "location" : "Authorization",
    "locationType" : "header",
    "message" : "Anonymous caller does not have storage.objects.list access to the Google Cloud Storage bucket.",
    "reason" : "required"
  } ],
  "message" : "Anonymous caller does not have storage.objects.list access to the Google Cloud Storage bucket."
}
    at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:150)
    at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:113)
    at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:40)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest$1.interceptResponse(AbstractGoogleClientRequest.java:401)
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1097)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:499)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:432)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:549)
    at com.google.cloud.storage.spi.v1.HttpStorageRpc.list(HttpStorageRpc.java:356)
    ... 23 more

Error: org.embulk.config.ConfigException: com.google.cloud.storage.StorageException: Anonymous caller does not have storage.objects.list access to the Google Cloud Storage bucket.

環境：

$ gcloud config list
[compute]
region = us-east1
zone = us-east1-c
[core]
account = [e-mail]
disable_usage_reporting = False
project = <project ID>

Your active configuration is: [default]


$ gcloud auth list  
    Credentialed Accounts
ACTIVE  ACCOUNT
*       [e-mail]

To set the active account, run:
    $ gcloud config set account `ACCOUNT`



$ gsutil ls   
gs://<bucket name>

GCPのIAM role：
オーナー

Answer 1

問題の切り分けでローカルで実行しました．

yamlファイルに以下変更を行い，サービスアカウントキーを発行＆ローカルに保存後，実行でGCE->BQのデータ取り込みに成功しました．

◾️XXXX.yaml
before

auth_method: compute_engine

after

auth_method: json_key
json_keyfile: /path/to/json_keyfile.json

Answer 2

GCSは全然詳しくないのですが、
この辺のAPIスコープの設定はされているのでしょうか？

Comments

[karl]

設定しています．GCEインスタンスも起動しています．

[hiroysato]

問題の切り分けで他の認証方法を試すのはいかがでしょうか？