firebase cloud function API Error with Google Cloud Storage

Question

With the introduction of Firebase Cloud Functions we are looking at moving some of our current node.js server side code to cloud functions. One issue I am having is with downloading a file from a GCS bucket to a temp file on disk, and then emailing that as an attachment (using mailgun-js).

The piece of code causing me grief is:

return mkdirp(tempLocalDir).then(() => {
    const bucket = gcs.bucket(gcsBucket);
    const tempFilePath = tempLocalDir + gcsFile;
    return bucket.file(gcsFile).download({
        destination: tempFilePath
    }).then(() => {
        console.log('File downloaded locally to', tempFilePath);
        var messageSubject = "Test";
        var messageBody = "Test with attach";

        var mailgunData = {
            from: ,
            to: agentEmail,
            subject: messageSubject,
            html: messageBody,
            attachment: tempFilePath,
        };
        mailgunAgent.messages().send(mailgunData, function (error, body) {
            console.log(body);
        });

    });

});

The error message I'm getting in the Functions Logs is:

ApiError: Forbidden
    at Object.parseHttpRespMessage (/user_code/node_modules/@google-cloud/storage/node_modules/@google-cloud/common/src/util.js:156:33)
    at Object.handleResp (/user_code/node_modules/@google-cloud/storage/node_modules/@google-cloud/common/src/util.js:131:18)
    at Duplexify.<anonymous> (/user_code/node_modules/@google-cloud/storage/src/file.js:724:21)
    at emitOne (events.js:96:13)
    at Duplexify.emit (events.js:188:7)
    at emitOne (events.js:96:13)
    at DestroyableTransform.emit (events.js:188:7)
    at emitOne (events.js:96:13)
    at Request.emit (events.js:188:7)
    at Request.<anonymous> (/user_code/node_modules/@google-cloud/storage/node_modules/request/request.js:1108:14)

I'm been able to download the file to the /tmp/ folder on disk using request, and this will be the fallback option, but I'd really like to use the GCS tools if possible. I "think" it's an auth error with GCS, but I'm not sure how to track that down. Do I need to have different auth parameters in the cloud functions .config() for GCS than for Firebase? If so, how do I enter them? Our GCS bucket and project pre-date the introduction of Firebase Storage, but we've successfully used it with the node functions running on our server.

Thanks in advance, Zach

Answer 1

Another way to solve this without attaching projectId or keyFilename:

1. Go to your project's Firebase console
2. Settings -> Permissions
3. IAM tab should be opened
4. Now give your 'App Engine default service account' and 'Google APIs service account' permissions for 'Storage admin' role
5. Should be fine now!