Attempting to export Cloud SQL db from GCE instance throws permission error

[rcun...@jobutrax.com]

I am trying to export my Cloud SQL database to my storage bucket when executing from a GCE instance, however I always seem to get the error "ERROR: (gcloud.sql.instances.export) Insufficient Permission". My command:

gcloud sql instances export my_cloudsql_name gs://my_bucket/backup.sql.gz --database my_db

I have enabled the Google Cloud Storage API and the Cloud SQL API and added the scopes compute-rw, sql-admin, storage-full. I have even gone as far as giving full access on all available scopes, but I still get the error. However, it seems to work ONLY if I use the cloud-platform scope, which is the "Allow API access to all Google Cloud services in the same project" checkbox. But it has to be that...I have no success manually selecting any scope permissions.

Is this intended or is there an issue here? I would be great to be able to export the database without exposing access to every API.

[Vadim Berezniker]

Is this a Second Generation instance?

--
You received this message because you are subscribed to the Google Groups "Google Cloud SQL discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-cloud-sql-d...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-cloud-sql-discuss/4997e8b1-8ecf-4f39-b79f-af87e556f420%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[rcun...@jobutrax.com]

The Cloud SQL instance is First Generation
The GCE instance is running the latest CentOS 6.7

On Tuesday, January 5, 2016 at 5:02:28 PM UTC-7, Vadim Berezniker wrote:

Is this a Second Generation instance?

On Tue, Jan 5, 2016 at 3:53 PM <rcun...@jobutrax.com> wrote:

I am trying to export my Cloud SQL database to my storage bucket when executing from a GCE instance, however I always seem to get the error "ERROR: (gcloud.sql.instances.export) Insufficient Permission". My command:

gcloud sql instances export my_cloudsql_name gs://my_bucket/backup.sql.gz --database my_db

I have enabled the Google Cloud Storage API and the Cloud SQL API and added the scopes compute-rw, sql-admin, storage-full. I have even gone as far as giving full access on all available scopes, but I still get the error. However, it seems to work ONLY if I use the cloud-platform scope, which is the "Allow API access to all Google Cloud services in the same project" checkbox. But it has to be that...I have no success manually selecting any scope permissions.

Is this intended or is there an issue here? I would be great to be able to export the database without exposing access to every API.

--
You received this message because you are subscribed to the Google Groups "Google Cloud SQL discuss" group.

To unsubscribe from this group and stop receiving emails from it, send an email to google-cloud-sql-discuss+unsub...@googlegroups.com.

[George]

Hello,

You can check if the service account is the active one on the instance by running the following command:

 gcloud auth list

If it's not the active account on the instance, then this might be causing your issue.

I hope this helps.

Sincerely,

George

[rcun...@jobutrax.com]

Yes the service account is the active one in the "Credentialed Accounts". The service account also has full permissions in my project.

[George]

Hello,

Is it possible to reply to me privately with the output of the following command from the GCE instance and with your project ID as well?

gcloud compute instances describe INSTANCE_NAME

Sincerely,

George

[Tianzhou Chen]

https://www.googleapis.com/auth/cloud-platform is required for exporting to Google Cloud Storage

https://cloud.google.com/sql/docs/admin-api/v1beta4/instances/export