title: gcloud.exceptions.Forbidden: 403 Missing or insufficient permissions
body: <p>I am a new to Google Cloud Platform. I have setup a Google VM Instance. I am facing an authentication issue on Local Machine while running the command:</p>
  
  <p><code>python manage.py makemigrations</code></p>
  
  <p>Can you please suggest some tips/steps to resolve the same ? </p>
  
  <p><strong>Error Trace</strong></p>
  
  <pre><code>  File "/constants.py", line 18, in &lt;module&gt;
      table_data = datastore_fetch(project_id, entity_kind)
    File "/datastore_helper.py", line 23, in datastore_fetch
      results = list(query.fetch())
    File "/venv/local/lib/python2.7/site-packages/gcloud/datastore/query.py", line 463, in __iter__
      self.next_page()
    File "/venv/local/lib/python2.7/site-packages/gcloud/datastore/query.py", line 434, in next_page
      transaction_id=transaction and transaction.id,
    File "/venv/local/lib/python2.7/site-packages/gcloud/datastore/connection.py", line 286, in run_query
      _datastore_pb2.RunQueryResponse)
    File "/venv/local/lib/python2.7/site-packages/gcloud/datastore/connection.py", line 124, in _rpc
      data=request_pb.SerializeToString())
    File "/venv/local/lib/python2.7/site-packages/gcloud/datastore/connection.py", line 98, in _request
      raise make_exception(headers, error_status.message, use_json=False)
  gcloud.exceptions.Forbidden: 403 Missing or insufficient permissions.
  </code></pre>
  
  <p>Other Info:</p>
  
  <pre><code>gcloud auth list
  Credentialed Accounts:
   - user_account@gmail.com ACTIVE
  To set the active account, run:
      $ gcloud config set account `ACCOUNT`
  
  gcloud config list
  Your active configuration is: [default]
  
  [core]
  account = user_account@gmail.com
  disable_usage_reporting = True
  project = user_project
  </code></pre>
  
  <p><strong>Input:</strong> (Standalone Python Function)</p>
  
  <pre><code>from gcloud import datastore
  client = datastore.Client('user_project')
  
  print(vars(client.connection.credentials))
  </code></pre>
  
  <p><strong>Output:</strong></p>
  
  <pre><code>{'scopes': set([]), 'revoke_uri': 'https://accounts.google.com/o/oauth2/revoke', 'access_token': None, 'token_uri': 'https://www.googleapis.com/oauth2/v4/token', 'token_info_uri': None, 'token_response': None, 'invalid': False, 'refresh_token': u'1/t-V_pZicXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'client_id': u'3XXXXXXXX9.apps.googleusercontent.com', 'id_token': None, 'client_secret': u'ZXXXXXXXXXXXXXXXXXXX2', 'token_expiry': None, 'store': None, 'user_agent': 'Python client library'}
  </code></pre>
  
  <p><strong>VM Details</strong></p>
  
  <pre><code>Firewalls
  Allow HTTP traffic 
  Allow HTTPS traffic
  
  Availability policies
  Preemptibility  Off (recommended)
  
  Automatic restart   
  On (recommended)
  
  On host maintenance 
  Migrate VM instance (recommended)
  
  Custom metadata
  None
  
  SSH Keys
  Block project-wide SSH keys
  None
  
  Service account
  service-account@user_project.iam.gserviceaccount.com
  
  Cloud API access scopes
  This instance has full API access to all Google Cloud services.
  </code></pre>
  
  <p>Thanks,</p>