GCP - Python 创建 IoT 设备 PermissionDenied

Question

我正在尝试通过 Python 脚本在 Google 云上创建物联网设备。我已经设置了项目、IoT 注册表并验证了我的 GCloud，并将 GOOGLE_APPLICATION_CREDENTIALS 链接到相应服务帐户的 json。为什么我使用命令行创建一个帐户，例如 gcloud iot devices create dev01 --project=... --region=... --registry=... , 有用。但是，我的 Python 脚本（运行通过命令提示符）似乎没有产生相同的结果。我使用 https://cloud.google.com/iot/docs/samples/device-manager-samples#iot-core-create-rs256-python 作为 iot_v1 参考。

    # Generate Key
    key = rsa.generate_private_key(backend=default_backend(), public_exponent=65537, key_size=2048)
    # Get Public
    public_key = key.public_key().public_bytes(serialization.Encoding.OpenSSH, serialization.PublicFormat.OpenSSH)
    # Get Private
    pem = key.private_bytes(encoding=serialization.Encoding.PEM,
                            format=serialization.PrivateFormat.TraditionalOpenSSL,
                            encryption_algorithm=serialization.NoEncryption())
    # Decode to UTF-8
    private_key_str = pem.decode('utf-8')
    public_key_str = public_key.decode('utf-8')
    # Write keys
    with open('Key Pairs/'+deviceName+'_private.pem', 'wb') as file:
        file.write(pem)
    with open('Key Pairs/' + deviceName + '_public.pem', 'wb') as file:
        file.write(public_key)

    # Create Device
    client = iot_v1.DeviceManagerClient()
    parent = client.registry_path(PROJECTID, REGION, REGISTRY)
    deviceTemplate = {
        'id': deviceName,
        "credentials": [
            {
                "public_key": {
                    "format": iot_v1.PublicKeyFormat.RSA_X509_PEM,
                    "key": public_key_str,
                }
            }
        ]
    }
    client.create_device(request={'parent': parent, 'device': deviceTemplate})

错误回溯是

File "commissioning.py", line 46, in <module>
    client.create_device(request={'parent': parent, 'device': deviceTemplate})
  File "C:\Users\Niels\AppData\Local\Programs\Python\Python38\lib\site-packages\google\cloud\iot_v1\services\device_manager\client.py", line 728, in create_device
    response = rpc(request, retry=retry, timeout=timeout, metadata=metadata,)
  File "C:\Users\Niels\AppData\Local\Programs\Python\Python38\lib\site-packages\google\api_core\gapic_v1\method.py", line 145, in __call__
    return wrapped_func(*args, **kwargs)
  File "C:\Users\Niels\AppData\Local\Programs\Python\Python38\lib\site-packages\google\api_core\grpc_helpers.py", line 59, in error_remapped_callable
    six.raise_from(exceptions.from_grpc_error(exc), exc)
  File "<string>", line 3, in raise_from
google.api_core.exceptions.PermissionDenied: 403 The caller does not have permission

我想这要么是我使用 iot_v1 的方式有问题，要么是 Python 的权限问题。任何 help/tips 将不胜感激！

Answer 1

确保用于创建客户端的服务帐户至少分配了 roles/cloudiot.provisioner 角色（如果您不断收到权限错误，请尝试向服务帐户添加 roles/cloudiot.admin 角色，因为它应该授予对所有 IoT 设备的完全控制权，请查找有关所有可用权限的更多信息 here。）

一旦您确定服务帐户具有正确的权限，您就可以利用文档 iot_v1.DeviceManagerClient() class to make sure you point to the service account key file as explained on the Authentication 部分提供的 credentials 参数。

GCP - Python 创建 IoT 设备 PermissionDenied

GCP - Python create IoT device PermissionDenied

python

google-cloud-platform

google-cloud-iot