Docker环境调用Google Speech API出现403权限拒绝问题排查

我用Python调用Google Speech API实现音频转文本，本地运行完全正常，但把相同代码和配置部署到Docker容器后，出现403权限拒绝错误，具体错误日志如下：

api-1    | grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
api-1    |      status = StatusCode.PERMISSION_DENIED
api-1    |      details = "Permission 'speech.recognizers.recognize' denied on resource (or it may not exist)."
api-1    |      debug_error_string = "UNKNOWN:Error received from peer ipv4:142.250.186.74:443 {grpc_message:\"Permission 'speech.recognizers.recognize' denied on resource (or it may not exist).\", grpc_status:7, created_time:\"2024-02-22T22:48:19.993472495+00:00\"}"

<and a bit further down>

api-1  | google.api_core.exceptions.PermissionDenied: 403 Permission 'speech.recognizers.recognize' denied on resource (or it may not exist). [reason: "IAM_PERMISSION_DENIED"
api-1  | domain: "iam.googleapis.com"
api-1  | metadata {
api-1  |   key: "permission"
api-1  |   value: "speech.recognizers.recognize"
api-1  | }

观察与思考 #

• 使用服务账号及下载的json密钥
• 代码运行在同一Docker环境下的NGINX反向代理之后
• Python代码调用其他外部服务无异常
• 本地及DigitalOcean的Docker环境均出现相同错误

疑问 #

• 是否有其他人遇到过该问题？
• 从Docker镜像调用Google服务有哪些注意事项？
• 运行在NGINX之后是否会影响请求？

更新【已解决】 #

经排查，问题根源是Docker镜像中未正确配置GOOGLE_APPLICATION_CREDENTIALS环境变量。虽尝试主动加载另一个密钥文件，但未生效，缺失该环境变量是导致问题的核心原因。

内容的提问来源于stack exchange，提问作者Kristian Vinther