如何用resourcemanager_v3 Python客户端获取GCP项目列表？遇403权限问题

问题描述 #

我使用GCP免费试用账号（无法创建组织），尝试通过google.cloud.resourcemanager_v3 Python客户端库获取所有GCP项目列表，已为服务账号配置项目所有者权限，但执行代码时遭遇403权限拒绝错误。

代码示例 #

from google.cloud import resourcemanager_v3
import os

os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = 'My Service Account JSON File'

# 创建Resource Manager API的客户端对象
client = resourcemanager_v3.ProjectsClient()

# 获取当前认证用户有权限访问的所有项目列表
projects = client.list_projects()

for project in projects:
    print(f"{project.project_id} ({project.name})")

报错信息 #

Traceback (most recent call last):
File "/home/jatin/.local/lib/python3.10/site-packages/google/api_core/grpc_helpers.py", line 72, in error_remapped_callable
return callable_(*args, **kwargs)
File "/home/jatin/.local/lib/python3.10/site-packages/grpc/_channel.py", line 946, in call
return _end_unary_response_blocking(state, call, False, None)
File "/home/jatin/.local/lib/python3.10/site-packages/grpc/_channel.py", line 849, in _end_unary_response_blocking
raise _InactiveRpcError(state)
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
status = StatusCode.PERMISSION_DENIED
details = "The caller does not have permission"
debug_error_string = "UNKNOWN:Error received from peer ipv4:142.250.194.202:443 {grpc_message:"The caller does not have permission", grpc_status:7, created_time:"2023-02-20T10:40:54.578602542+05:30"}"

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/home/jatin/work/official Scripts/test2.py", line 14, in
projects = client.list_projects()
File "/home/jatin/.local/lib/python3.10/site-packages/google/cloud/resourcemanager_v3/services/projects/client.py", line 659, in list_projects
response = rpc(
File "/home/jatin/.local/lib/python3.10/site-packages/google/api_core/gapic_v1/method.py", line 113, in call
return wrapped_func(*args, **kwargs)
File "/home/jatin/.local/lib/python3.10/site-packages/google/api_core/retry.py", line 349, in retry_wrapped_func
return retry_target(
File "/home/jatin/.local/lib/python3.10/site-packages/google/api_core/retry.py", line 191, in retry_target
return target()
File "/home/jatin/.local/lib/python3.10/site-packages/google/api_core/timeout.py", line 120, in func_with_timeout
return func(*args, **kwargs)
File "/home/jatin/.local/lib/python3.10/site-packages/google/api_core/grpc_helpers.py", line 74, in error_remapped_callable
raise exceptions.from_grpc_error(exc) from exc
google.api_core.exceptions.PermissionDenied: 403 The caller does not have permission

问题原因及解决办法 #

1. 免费试用账号的核心限制 #

GCP免费试用账号没有组织层级的访问权限，默认调用list_projects()时，API会尝试遍历组织下的所有项目，这超出了免费账号的权限范围，直接触发403错误。

2. 权限配置验证 #

即使给服务账号分配了项目所有者权限，仍需确认：

• 权限是否已生效：GCP权限变更通常需要1-5分钟的同步时间，等待后再重试
• 是否添加了显式的项目列表权限：给服务账号额外添加Resource Manager Viewer或Project Viewer角色，确保拥有项目列表的访问权限

3. 代码修改方案 #

方案一：指定单个项目查询

如果只需要获取当前项目的信息，修改代码指定parent参数为当前项目ID（格式为projects/[你的项目ID]），避免访问组织级资源：

from google.cloud import resourcemanager_v3
import os

os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = 'My Service Account JSON File'

client = resourcemanager_v3.ProjectsClient()

# 替换为你的项目ID
request = resourcemanager_v3.ListProjectsRequest(
    parent="projects/your-project-id"
)

projects = client.list_projects(request=request)

for project in projects:
    print(f"{project.project_id} ({project.name})")

方案二：使用搜索接口获取所有可访问项目

如果需要获取所有有权限的项目，改用search_projects()方法，该方法不需要组织权限，会返回当前账号能访问的所有项目：

from google.cloud import resourcemanager_v3
import os

os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = 'My Service Account JSON File'

client = resourcemanager_v3.ProjectsClient()

# 空查询返回所有可访问项目
response = client.search_projects(query="")

for project in response:
    print(f"{project.project_id} ({project.name})")

额外检查项 #

• 确认服务账号JSON密钥文件的路径正确，无拼写错误
• 用gcloud auth activate-service-account --key-file=your-key.json命令验证密钥是否能正常完成认证
• 在GCP控制台的API库中，确认Resource Manager API已启用

内容的提问来源于stack exchange，提问作者Jatin