IssueTracker

When running a Cloud Scheduler job that sends a POST request to Cloud Asset API URL in another project you will receive an error message saying "PERMISSION_DENIED" if you do not have the Cloud Asset API enabled in the project where Cloud Scheduler is running.

What you expected to happen: A more detailed error explaining that the reason for the error is that the API that you are trying to reach is not enabled.

Summary of steps to reproduce:Create projects A and B. You will create a Cloud Scheduler job in project B to export an asset from project A to a Big Query table in project B by sending a POST request to a Cloud Asset API URL.

Steps to reproduce:

1.- Create projects A and B and enable Compute Engine API in Project A and Big Query and Cloud Scheduler APIs in project B.

2.- Create a VM in project A

3.- Create a Big Query dataset in project B

4.- Create a service account in project B. This is the service account that you will use when configuring the execution of the Cloud Scheduler job.

5.- Bind the Asset Viewer role to the above service account in project A

6.- Create a Cloud Scheduler job in project B:

Target type = HTTP
URL = https://cloudasset.googleapis.com/v1/projects/PROJECT_A_NUMBER:exportAssets
HTTP method = POST
Body =
{
"assetTypes": [
"compute.googleapis.com/Instance"
],
"contentType": "RESOURCE",
"outputConfig": {
"bigqueryDestination": {
"dataset": "projects/PROJECT_B_ID/datasets/DATASET_NAME",
"force": true,
"table": "TABLE_NAME"
}
}
}

7.- Run the job. It will fail with the "PERMISSION_DENIED" message if the Cloud Asset API is not enabled in project B. The error needs to be more specific.

Thanks for your help!