PermissionDenied: 403 IAM permission 'dialogfl

问题:

I'm trying to get the list of the intents in my Dialogflow agent using Dialogflow's V2 APIs but have been getting the following error:

---

PermissionDenied: 403 IAM permission 'dialogflow.intents.list' on 'projects/xxxx/agent' denied.

I adopted the following steps:

1. I created a new agent(with V2 APIs enabled) and a new service account for it.
2. I downloaded the JSON key and set my GOOGLE_APPLICATION_CREDENTIALS variable to its path.

Following is my code:

import dialogflow_v2 as dialogflow

os.environ["GOOGLE_APPLICATION_CREDENTIALS"]="/home/user/folder/service-account-key.json"

client=dialogflow.IntentsClient()

parent = client.project_agent_path('[PROJECT_ID]')

for element in client.list_intents(parent):
    pass

I have made various agents and service accounts and even changed the role from Admin to Client but can't figure out any solution. I tried the following solution but didnt' work

Tried Solution: DialogFlow PermissionDenied: 403 IAM permission 'dialogflow.sessions.detectIntent'

回答1:

1. In Dialogflow's console, go to settings ⚙ > under the general tab, you'll see the project ID section with a Google Cloud link to open the Google Cloud console > Open Google Cloud.
2. (Optional) In the Cloud console, go to the menu icon > APIs & Services > Library. Select any APIs (if any) > Enable.
3. In Cloud Console > under the menu icon ☰ > APIs & Services > Credentials > Create Credentials > Service Account Key. Under Create service account key, select New Service Account from the dropdown and enter a project name and for role choose Owner > Create.
   • JSON private key file will be downloaded to your local machine that you will need.

For Javascript: In the index.js file you can do service account auth with JWT:

const serviceAccount = {};       // Starts with {"type": "service_account",...

// Set up Google Calendar Service account credentials
  const serviceAccountAuth = new google.auth.JWT({
  email: serviceAccount.client_email,
  key: serviceAccount.private_key,
  scopes: 'https://www.googleapis.com/auth/xxxxxxx'
});

For Python: There's a Google Auth Python Library available via pip install google-auth and you can check out more here.

回答2:

There is no need for creating a new Agent. You can edit the existing agents IAM.

1. In Dialogflow's console, go to settings ⚙ > under the general tab, you'll see the project ID section with a Google Cloud link to open the Google Cloud console > Open Google Cloud.
2. In google cloud, go to IAM Admin > IAM under tab Members. Find the name of your agents and then click on edit.
3. Give admin permissions to the agent to give permissions to list intent.

回答3:

This error message is usually thrown when the application is not being authenticated correctly due to several reasons such as missing files, invalid credential paths, incorrect environment variables assignations, among other causes. Keep in mind that when you set an environment variable value in a session, it is reset every time the session is dropped.

Based on this, I recommend you to validate that the credential file and file path are being correctly assigned, as well as follow the Obtaining and providing service account credentials manually guide, in order to explicitly specify your service account file directly into your code; In this way, you will be able to set it permanently and verify if you are passing the service credentials correctly.

Passing the path to the service account key in code example:

def explicit():
from google.cloud import storage

# Explicitly use service account credentials by specifying the private key
# file.
storage_client = storage.Client.from_service_account_json('service_account.json')

# Make an authenticated API request
buckets = list(storage_client.list_buckets())
print(buckets)

回答4:

When you create the intentClient, use following:

key_file_path = "/home/user/folder/service-account-key.json";
client=dialogflow.IntentsClient({
        keyFilename: key_file_path
})

Intents list

回答5:

The problem lies in the IAM section of GCP. Probably you are making a POST request with a role that does not have the necessary authorizations.

1. Look into your key.json file that contains the field "client_email"
2. Proceed to the IAM page and set the relevant role with that email to a role that has posting capabilities. (e.g. Admin)

This solved my problem.