使用Fog和Carrierwave存储文件到GCS时遇Excon::Error::Forbidden错误

Hey there, let's tackle this 403 Forbidden error you're hitting when switching from S3 to Google Cloud Storage (GCS) with Carrierwave and Fog. I've seen this pop up a few times, so here are the most common fixes to try out:

First things first—double-check your service account key setup:

• Make sure you downloaded the JSON format key file from GCP (not p12 or other formats). JSON is required for Fog-Google to authenticate correctly.
• Confirm your Carrierwave config points to the right key file path, or if using an environment variable, ensure the JSON string isn't corrupted (no extra spaces, missing brackets, or escaped quotes).
  Example config snippet:

  CarrierWave.configure do |config|
    config.fog_provider = 'fog/google'
    config.fog_credentials = {
      provider: 'Google',
      google_project: 'your-gcp-project-id', # Use the project ID (not display name)
      google_json_key_location: Rails.root.join('config', 'gcs-service-account.json').to_s
      # Alternative for env vars: google_json_key_string: ENV['GCS_JSON_KEY']
    }
    config.fog_directory = 'your-unique-bucket-name'
  end
  

A 403 often means missing access rights:

• Head to the GCP Console, find your service account, and assign it the Storage Object Creator and Storage Object Viewer roles (stick to least privilege instead of full Storage Admin if possible).
• Also verify your bucket's permissions: ensure the service account is listed with write access in the bucket's "Permissions" tab.

• GCS bucket names are globally unique and case-insensitive (but stick to lowercase to avoid issues). Make sure fog_directory matches your bucket's exact name.
• google_project must be your GCP project's ID (the lowercase alphanumeric string, not the human-readable project name).

It's easy to forget this step! Go to the GCP API Library, search for Cloud Storage API, and make sure it's enabled for your project. Without this, all requests to GCS will be rejected.

Older versions of the fog-google gem might have compatibility issues with GCS's API. Run this to update to the latest version:

bundle update fog-google

Also ensure your Carrierwave version is compatible (Carrierwave 2.x+ works best with recent fog-google releases).

The error mentions a malformed or missing signature—this usually points to a corrupted key file:

• Re-download the service account JSON key from GCP and replace your existing file.
• If using an environment variable, paste the entire JSON content into the variable without modifying any characters (avoid auto-formatting that breaks the JSON structure).

Bonus Debug Tip #

Enable Fog's debug mode to see full request/response details, which can help pinpoint exactly where things are going wrong:

config.fog_attributes = { 'debug' => true }

Give these steps a try one by one—more often than not, the issue is a misconfigured credential or missing permission. Let me know if any of these fix your problem!

内容的提问来源于stack exchange，提问作者Yuri Gert