Export using gcloud cli and api not working, but working via console

[Freark van der Bos]

Hi there,

This issue seems to have cropped up since somewhere between last Friday 12:53:19 PM CEST and 5:38:07 PM CEST. We have an application which makes database backups by exporting specific database to one of our storage buckets on demand by issuing a request via an API call. This started failing with a message in the operations log like "gs://<bucketname>/<path_in_bucket>.sql: Access denied for account <small_base64_string>@speckle-umbrella-9.iam.gserviceaccount.com (permission issue?)".

Running a manual export via the gcloud cli, like "gcloud sql instances export <instance_name> gs://<bucketname>/<path_in_bucket>.sql --database=<database_name>",  also fails with the same message in the operations log and with a message on the terminal like:

Exporting Cloud SQL instance...failed.
ERROR: (gcloud.sql.instances.export) ERROR_RDBMS

Running a manual export via the web console is working, though.

To eliminate the possibility of a permission issue with a service account or with the bucket, I made a cloudsql instance and bucket on a separate GCP project and account and I seem to run into the same situation there. Exporting via gcloud cli fails, but running it from the web console is working. The difference seem to be there even when not using a services account, but the same user account on both the cli and the console.

I am wondering, are there any others experiencing something similar indicating a wider issue, or am I making a logical thinking error and failing to see what I'm doing wrong here?

[Freark van der Bos]

I guess it might be my lack in precisely following the instructions which caused my reproduction of the issue on another project to generate a false positive. I neglected to follow steps 2, 3 and 4 in the section "Exporting data to a SQL dump file" for "GCLOUD (2ND GEN)" on https://cloud.google.com/sql/docs/mysql/import-export/exporting . After that the issue is gone on my reproduced environment.

As for the cause of the issue on the original environment, my hypothesis would be that someone here thought, "Hey, this speckle-umbrella service account is probably not needed anymore, lets remove it.".

My apologies for bothering people here, though hopefully a future-me will find this find this post and check that ACL setting. :)