Default credential for app engine project accessing google cloud storage?

Question

I have an app engine project, I want to access my google cloud storage default bucket. The first step of getting a Credential object fails, doing the following on a live instance:

Credential creds = GoogleCredential.getApplicationDefault();

The exception message I get:

"The Application Default Credentials are not available. They are available if running in Google Compute Engine. Otherwise, the environment variable GOOGLE_APPLICATION_CREDENTIALS must be defined pointing to a file defining the credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information."

The doc here says that production app engine projects should have access to the default credentials?:

https://developers.google.com/identity/protocols/application-default-credentials

"3. If you are running in Google App Engine production, the built-in service account associated with the application will be used."

Is there some setup I'm missing?

My app engine version (gradle):

com.google.appengine:appengine-java-sdk:1.9.18

and google cloud storage lib version:

com.google.apis:google-api-services-storage:v1-rev35-1.20.0

Thanks

Solution

Go to Google Developers Console -> Credentials and create a default service account .json key. When you do that, it will download a file like default-account-credentials.json for you. You must then put that file somewhere in your app engine project. This file will be referenced when you call

Credential creds = GoogleCredential.getApplicationDefault();

However, before that works you must set the environmental variable to that files location. To do that open up your appengine-web.xml file and put this line into it:

<env-variables>
            <env-var name="GOOGLE_APPLICATION_CREDENTIALS"
                value="WEB-INF/default-account-credentials.json" />
        </env-variables>

Where value is the path to your .json creds file you just downloaded.

Now it will work. (your gradle imports are fine)

Comments

[Rashmi]

I have followed above steps and added the environment variables of the downloaded file. Still I am getting exception: Nested in java.lang.ExceptionInInitializerError: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "modifyThreadGroup") at java.security.AccessControlContext.checkPermission(AccessCon‌​trolContext.java:484‌​) Please suggest if any other step needs to be done. Thanks in advance for your help.

[Aseem]

How to put a file in app engine? docs say app engine will automatically use default service account.

[Timofey]

I don't this it is correct to store creds with you app, according to the documentation they must be accessible from the app engine (as the author suggests)