传入指定服务账号密钥调用Google Storage API仍用默认账号如何解决

你调用Storage构造函数时传入的参数名错误，@google-cloud/storage SDK 识别服务账号密钥的参数是credentials，不是你自定义的accessKey，所以SDK没有读取到你传入的密钥，自动 fallback 到了运行环境的默认服务账号，也就是报错中提到的gcp-myprojectid@appspot.gserviceaccount.com。

将构造参数中的accessKey改为credentials即可，修正后的代码如下：

var serviceAccountKey = {
  "type": "service_account",
  "project_id": "...",
  "private_key_id": "...",
  "private_key": "...",
  "client_email": "myserviceaccount@gcp-serviceaccounts-keys.iam.gserviceaccount.com",
  "client_id": "...",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "..."
};
const projectId = "...";
const { Storage } = require('@google-cloud/storage');
// 替换参数名为SDK可识别的credentials
const storage = new Storage({projectId, credentials: serviceAccountKey});
const bucket = storage.bucket('test-bucket-aa');

• 确认你传入的private_key内容完整，换行符\n没有被意外转义或删除
• 确认自定义服务账号myserviceaccount@gcp-serviceaccounts-keys.iam.gserviceaccount.com已经被授予目标存储桶对应的权限，比如你需要用到的storage.objects.get操作权限
• 如果运行环境在Google Cloud内部（比如App Engine、Cloud Function、Compute Engine），显式传入credentials参数的优先级高于环境默认服务账号，无需额外调整环境配置。

内容的提问来源于stack exchange，提问作者Bill Software Engineer