node.js - 如何从 Google Cloud Functions NodeJS 连接到 Google Cloud Storage

Question

我有以下代码示例，它接收一个 bufferedImage 及其 mimeType，然后将其上传到 Google Cloud Storage。

一切正常，但由于某种原因，我的 Google Cloud Function 从 Storage API 收到了 403 错误。

我该怎么做才能让我的 GC 函数访问 GC 存储？

我在文档中找不到任何可以告诉我如何执行此操作的内容。

const { Storage } = require('@google-cloud/storage');

// Creates a client
const storage = new Storage();

// Lists all buckets in the current project
const buckets = storage.getBuckets();

exports.uploadImage = (bucketName, fileName, imageBuffer, mimeType) => {
  return new Promise((resolve, reject) => {

    let bucket = storage.bucket(bucketName);

    let file = bucket.file(fileName);
    file.save(imageBuffer,
        {
            metadata: { contentType: `image/${mimeType}` },
        },
        ((error) => {
            error ? reject(error) : resolve()
        })
    );
  })
}

这是我得到的错误

{"code":403,"errors":[{"domain":"global","reason":"forbidden","message":"directed-galaxy-221521@appspot.gserviceaccount.com does not have storage.objects.create access to blog/e33f9c9d-65f0-4a7f-8332-29846f770e6d."}],"message":"directed-galaxy-221521@appspot.gserviceaccount.com does not have storage.objects.create access to blog/e33f9c9d-65f0-4a7f-8332-29846f770e6d."}

Answer 1

云功能 (CF) 由特定服务帐户执行(在您的情况下是 directed-galaxy-221521@appspot.gserviceaccount.com )。来自 Runtime service account :

During function execution, Cloud Functions uses the service account PROJECT_ID@appspot.gserviceaccount.com as an identity.

由于您在访问存储桶/文件时收到 403 错误，这意味着它们不可公开访问，因此您需要为上述服务帐户授予必要的访问权限(至少 storage.objects.create ，在错误消息)根据 Access Control Option您为您的存储选择和配置。