从 Google PubSub 提取消息不起作用 - 权限被拒绝

Question

我正在尝试从现有订阅中提取消息，但每次尝试时都会收到PERMISSION_DENIED错误。不过，测试权限会为"pubsub.subscriptions.consumption"返回"true"。也许这与使用现有订阅而不是创建新订阅有关？不过，我还没有找到一种方法来做到这一点，并且每个在线示例都以相同的方式进行。

TopicName topic = TopicName.create("cloud-project", "sn-1000");
SubscriptionName subscription = SubscriptionName.create("cloud-project", "sn-1000");
String accountFile = "ServiceAccount_sn-1000.json";
CredentialsProvider credentialsProvider = FixedCredentialsProvider.create(
ServiceAccountCredentials.fromStream(new FileInputStream(accountFile))
);
SubscriptionAdminSettings subscriptionAdminSettings =
SubscriptionAdminSettings.defaultBuilder()
.setCredentialsProvider(credentialsProvider)
.build();
// THIS IS WHERE IT FAILS
SubscriptionAdminClient subscriptionAdminClient =
SubscriptionAdminClient.create(subscriptionAdminSettings);
subscriptionAdminClient.createSubscription(subscription, topic, PushConfig.getDefaultInstance(), 0);
Subscriber subscriber = Subscriber.defaultBuilder(subscription, new MyMessageReceiver()).build();
subscriber.addListener(new Subscriber.Listener() {
@Override
public void failed(Subscriber.State from, Throwable failure) {
// Handle failure. This is called when the Subscriber encountered a fatal error and is shutting down.
System.err.println(failure);
}
}, MoreExecutors.directExecutor());
subscriber.startAsync().awaitRunning();
if(subscriber.state().equals(ApiService.State.FAILED)) {
subscriber.stopAsync().awaitTerminated();
return;
}
//Printing messages written to a buffer in the custom MyMessageReceiver class, which implements MessageReceiver
subscriber.stopAsync().awaitTerminated();

在控制台中执行此代码时，我收到此错误：

com.google.api.gax.grpc.GrpcApiException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: User not authorized to perform this action.
at com.google.api.gax.grpc.GrpcExceptionCallable$ExceptionTransformingFuture.onFailure(GrpcExceptionCallable.java:112)
at com.google.api.core.ApiFutures$1.onFailure(ApiFutures.java:53)
at com.google.common.util.concurrent.Futures$4.run(Futures.java:1123)
at com.google.common.util.concurrent.MoreExecutors$DirectExecutor.execute(MoreExecutors.java:435)
at com.google.common.util.concurrent.AbstractFuture.executeListener(AbstractFuture.java:900)
at com.google.common.util.concurrent.AbstractFuture.complete(AbstractFuture.java:811)
at com.google.common.util.concurrent.AbstractFuture.setException(AbstractFuture.java:675)
at io.grpc.stub.ClientCalls$GrpcFuture.setException(ClientCalls.java:466)
at io.grpc.stub.ClientCalls$UnaryStreamToFuture.onClose(ClientCalls.java:442)
at io.grpc.internal.ClientCallImpl.closeObserver(ClientCallImpl.java:426)
at io.grpc.internal.ClientCallImpl.access$100(ClientCallImpl.java:76)
at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.close(ClientCallImpl.java:512)
at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.access$700(ClientCallImpl.java:429)
at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInContext(ClientCallImpl.java:544)
at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:52)
at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:117)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: io.grpc.StatusRuntimeException: PERMISSION_DENIED: User not authorized to perform this action.
at io.grpc.Status.asRuntimeException(Status.java:543)
... 15 more

Answer 1

失败的行是您尝试创建订阅的行，而不是您尝试使用消息的行。"pubsub.subscriptions.consumption"权限不足以创建订阅。访问控制页面详细介绍了执行不同操作所需的权限。为了创建订阅，所需的权限是包含云项目的"pubsub.subscriptions.create"和请求主题上的pubsub.topics.attachSubscription。请注意，若要在项目 A 中对项目 B 中的主题 T 创建订阅，必须同时授予对项目 A 和主题 T 的相应权限。

如果订阅已存在，则无需再次调用 createSubscription，只需创建订阅者对象：

ProjectSubscriptionName subscriptionName = ProjectSubscriptionName.of("cloud-project", "sn-1000");
Subscriber subscriber = Subscriber.newBuilder(subscriptionName, new MyMessageReceiver()).build();