pythongoogle-bigquerygoogle-authenticationscopesgoogle-auth-library

google.cloud.bigquery.Client() ignoring provided scopes, resulting in Permission denied while getting Drive credentials

I am trying to query data stored in Drive via the google.cloud.bigquery Python library.

I've followed Google's guide for Querying Drive Data. Thus, my code looks like this:

import google.auth
from google.cloud import bigquery

credentials, project = google.auth.default(
    scopes=[
        "https://www.googleapis.com/auth/drive",
        "https://www.googleapis.com/auth/bigquery",
    ]
)
client = bigquery.Client(project, credentials)

query = client.query("""MY SQL HERE""")
query_results = query.result()

The issue is: The credentials object and bigquery client ignores the provided scopes, resulting in google.api_core.exceptions.Forbidden: 403 Access Denied: BigQuery BigQuery: Permission denied while getting Drive credentials. To clarify, neither credentials nor client include the drive scope provided.

What can I do to properly pass the drive scope to my bigquery client?

My application default credentials for my local environment is my authorized user, which is the owner of the project.

Solution

  • Once you've set your application default credentials as an authorized user, you cannot request additional scopes.

    To request additional scopes, do so during activation of your authorized user.

    More plainly, when you run gcloud auth application-default login, provide the --scopes option, followed by your desired scopes. For me, that was gcloud auth application-default login --scopes=openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/bigquery