执行Stackdriver AsyncReporter健康检查时遇GCP权限拒绝错误

执行Stackdriver AsyncReporter健康检查时触发权限拒绝错误，且无法从官方文档找到该操作所需的认证范围。

错误栈信息 #

io.grpc.StatusRuntimeException: PERMISSION_DENIED: The caller does not have permission
    at io.grpc.Status.asRuntimeException(Status.java:535)
    at zipkin2.reporter.stackdriver.internal.AwaitableUnaryClientCallListener.onClose(AwaitableUnaryClientCallListener.java:100)
    at io.grpc.internal.DelayedClientCall$DelayedListener$3.run(DelayedClientCall.java:463)
    at io.grpc.internal.DelayedClientCall$DelayedListener.delayOrExecute(DelayedClientCall.java:427)
    at io.grpc.internal.DelayedClientCall$DelayedListener.onClose(DelayedClientCall.java:460)
    at io.grpc.internal.ClientCallImpl.closeObserver(ClientCallImpl.java:562)
    at io.grpc.internal.ClientCallImpl.access$300(ClientCallImpl.java:70)
    at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInternal(ClientCallImpl.java:743)
    at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInContext(ClientCallImpl.java:722)
    at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37)
    at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:133)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
    at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
    at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.base/java.lang.Thread.run(Unknown Source)

当前使用的认证范围 #

Scopes in use by default credentials: 

[https://www.googleapis.com/auth/pubsub,
 https://www.googleapis.com/auth/spanner.admin,
 https://www.googleapis.com/auth/spanner.data, 
 https://www.googleapis.com/auth/datastore, 
 https://www.googleapis.com/auth/sqlservice.admin, 
 https://www.googleapis.com/auth/devstorage.read_only, 
 https://www.googleapis.com/auth/devstorage.read_write, 
 https://www.googleapis.com/auth/cloudruntimeconfig, 
 https://www.googleapis.com/auth/trace.append,
 https://www.googleapis.com/auth/cloud-platform,
 https://www.googleapis.com/auth/cloud-vision, 
 https://www.googleapis.com/auth/bigquery,
 https://www.googleapis.com/auth/monitoring.write]

问题排查与解决 #

Stackdriver AsyncReporter的健康检查会调用Stackdriver Trace的服务端点做连通性验证，核心需要Trace资源的读取权限。虽然你已配置trace.append和cloud-platform范围，但健康检查可能需要额外的权限支持：

1. IAM角色配置
   给应用使用的服务账号绑定roles/cloudtrace.agent角色——这个角色包含Trace写入权限和健康检查所需的基础验证权限，完全匹配Reporter的使用场景；如果只需健康检查，roles/cloudtrace.viewer角色也能满足需求。

2. OAuth范围补充
   若你依赖OAuth范围而非IAM角色控制权限，需添加https://www.googleapis.com/auth/trace.read到认证范围列表中。

3. 注意事项
   cloud-platform范围理论上覆盖所有Cloud资源权限，但如果服务账号未被授予对应的IAM角色，仍会出现权限拒绝。此时必须检查服务账号的IAM绑定，确保其拥有Stackdriver Trace相关角色。

验证步骤 #

• 给服务账号绑定上述推荐角色；
• 若用自定义范围，添加trace.read；
• 重启应用后重新执行健康检查。

内容的提问来源于stack exchange，提问作者i-haidar