The error "403 Cloud IAM permission 'cloudtranslate.glossaries.create' denied. " has occurred.

[今村由貴]

Hello,

I am facing the issue that the error occurred when I executed the python code below.

Please note that I granted the permission such as "Cloud Translation API admin" and "storage object viewer (or upper permission)" to my service account on the GCP, but it doesn't work.

I even granted project owner to the service account but the same error still persists.

Can somebody help me to resolve the issue because I have been stuck in this all day today?

This is executed code

----------------------------------

from google.cloud import translate_v3beta1 as translate

client = translate.TranslationServiceClient()

project_id = '*******'

glossary_id = '********'

location = 'us-central1'  # The location of the glossary

name = client.glossary_path(

    project_id,

    location,

    glossary_id)

language_codes_set = translate.types.Glossary.LanguageCodesSet(

    language_codes=['ja', 'en'])

gcs_source = translate.types.GcsSource(

    input_uri='gs://*********/Glossary-translate201909.csv')

input_config = translate.types.GlossaryInputConfig(

    gcs_source=gcs_source)

glossary = translate.types.Glossary(

    name=name,

    language_codes_set=language_codes_set,

    input_config=input_config)

parent = client.location_path(project_id, location)

operation = client.create_glossary(parent=parent, glossary=glossary)

result = operation.result(timeout=90)

print('Created: {}'.format(result.name))

print('Input Uri: {}'.format(result.input_config.gcs_source.input_uri))

----------------------------------

The error says below.

----------------------------------

Exception has occurred: PermissionDenied

403 Cloud IAM permission 'cloudtranslate.glossaries.create' denied. 

  File "C:\Users\h1015543\Documents\Python-study\v3beta1\Creating_a_glossary_resource.py", line 32, in <module>

    operation = client.create_glossary(parent=parent, glossary=glossary)

----------------------------------

Thank you very much in advance.

[Ali T (Cloud Platform Support)]

Hi,

As per the predefined IAM roles, the ‘Cloud Translation API admin’ role you assigned is sufficient to be able to create glossaries. As the error message indicates the ‘cloudtranslate.glossaries.create’ permission was denied, I suspect another service account than the one you expect is making the call. 

I would suggest re-exporting the GOOGLE_APPLICATION_CREDENTIALS against the expected service account key. Additionally, in your project’s Stackdriver logs under the “Audited Resource” section, you can find the requests launched to create a glossary. You can use the log filter below to quickly find these entries. I would suggest expanding the log entry and confirming the principalEmail indicated is in fact the service account you granted the Translation API admin roles. 

resource.type="audited_resource"

resource.labels.service="translate.googleapis.com"

resource.labels.method="google.cloud.translation.v3beta1.TranslationService.CreateGlossary"

[今村由貴]

Dear Ali

Thank you very much for your support.

The issue was resolved because of your advice.

Another issue (below) has occurred after that, but I think I can handle this so you can close this now.

F.Y.I

 Exception has occurred: GoogleAPICallError

None Failed to parse content of input file. Error: Not enough valid languages in CSV file. Must have terms for at least two different languages. num_valid_languages_in_csv = 1

  File "C:\Users\h1015543\Documents\Python-study\v3beta1\Creating_a_glossary_resource.py", line 35, in <module>

    result = operation.result(timeout=90)

[Nikolay G]

If you still need help, please share some sample CSV file and a code example to reproduce this error