<p>I am trying to access a secret on GCP Secrets and I get the following error :</p>
<pre><code>in get_total_results &quot;api_key&quot;: get_credentials(&quot;somekey&quot;).get(&quot;somekey within key&quot;), File
 &quot;/helper.py&quot;, line 153, in get_credentials response = client.access_secret_version(request={&quot;name&quot;: resource_name})
 File &quot;/usr/local/lib/python3.8/site-packages/google/cloud/secretmanager_v1/services/secret_manager_service/client.py&quot;, 
line 1136, in access_secret_version response = rpc(request, retry=retry, timeout=timeout, metadata=metadata,) 
File &quot;/usr/local/lib/python3.8/site-packages/google/api_core/gapic_v1/method.py&quot;, line 145, in __call__ 
return wrapped_func(*args, **kwargs) File &quot;/usr/local/lib/python3.8/site-packages/google/api_core/retry.py&quot;, line 285, in retry_wrapped_func return retry_target( File &quot;/usr/local/lib/python3.8/site-packages/google/api_core/retry.py&quot;, 
line 188, in retry_target return target() File &quot;/usr/local/lib/python3.8/site-packages/google/api_core/grpc_helpers.py&quot;, 
line 69, in error_remapped_callable six.raise_from(exceptions.from_grpc_error(exc), exc) File &quot;&lt;string&gt;&quot;, 
line 3, in raise_from google.api_core.exceptions.PermissionDenied: 
403 Request had insufficient authentication scopes.
</code></pre>
<p>The code is fairly simple:-</p>
<pre><code>def get_credentials(secret_id):
    project_id = os.environ.get(&quot;PROJECT_ID&quot;)
    resource_name = f&quot;projects/{project_id}/secrets/{secret_id}/versions/1&quot;

    client = secretmanager.SecretManagerServiceClient()
    response = client.access_secret_version(request={&quot;name&quot;: resource_name})

    secret_string = response.payload.data.decode(&quot;UTF-8&quot;)
    secret_dict = json.loads(secret_string)
    return secret_dict
</code></pre>
<p>So, what I have is a cloud function, which is deployed using Triggers, and uses a service account which has the Owner role.</p>
<p>The cloud function triggers a Kubernete Work Job and creates a container, which downloads a repo inside the container and executes it.</p>
<p>Dockerfile is:</p>
<pre><code>FROM gcr.io/project/repo:latest
FROM python:3.8-slim-buster
COPY . /some_dir
WORKDIR /some_dir
COPY --from=0 ./repo /a_repo
RUN pip install -r requirements.txt &amp; pip install -r a_repo/requirements.txt 
ENTRYPOINT [&quot;python3&quot; , &quot;main.py&quot;]
</code></pre>

<p>The GCE instance might not have the correct authentication scope.</p>
<p>From: <a href="https://developers.google.com/identity/protocols/oauth2/scopes#secretmanager" rel="noreferrer">https://developers.google.com/identity/protocols/oauth2/scopes#secretmanager</a></p>
<p><code>https://www.googleapis.com/auth/cloud-platform</code> is the required scope.</p>
<p>When creating the GCE instance you need to select the option that gives the instance the correct scope to call out to cloud APIs: <a href="https://i.stack.imgur.com/CQFjz.png" rel="noreferrer"><img src="https://i.stack.imgur.com/CQFjz.png" alt="from the cloud console" /></a></p>
