System test for 'Topic.check_iam_permissions' fails with 503

[tseaver]

While working on a new system test for Topic.check_iam_permissions (the wrapper for projects.topics.testIamPermissions), the back-end consistently fails the API call with a 503::

(Pdb) pp content
'{\n  "error": {\n    "code": 503,\n    "message": "The service was unable to fulfill your request. Please try again. [code=8a75]",\n    "status": "UNAVAILABLE"\n  }\n}\n'
(Pdb) pp response
{'-content-encoding': 'gzip',
 'alt-svc': 'quic=":443"; ma=2592000; v="32,31,30,29,28,27,26,25"',
 'alternate-protocol': '443:quic',
 'cache-control': 'private',
 'content-length': '162',
 'content-type': 'application/json; charset=UTF-8',
 'date': 'Fri, 01 Apr 2016 16:20:35 GMT',
 'server': 'ESF',
 'status': '503',
 'transfer-encoding': 'chunked',
 'vary': 'Origin, X-Origin, Referer',
 'x-content-type-options': 'nosniff',
 'x-frame-options': 'SAMEORIGIN',
 'x-xss-protection': '1; mode=block'}
(Pdb) pp method
'POST'
(Pdb) pp url
'https://pubsub.googleapis.com/v1/projects/citric-celerity-697/topics/ex_topic_iam_policy-1459527567594:testIamPermissions'

@tmatsuo does that extra code (8a75) tell you anything about the failure?

[tmatsuo]

Sorry my e-mail client didn't do a good job of filtering. Is this still a problem? What's the request body?

[tseaver]

@tmatsuo the request is now failing with a 400, rather than a 503:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "gcloud/pubsub/topic.py", line 395, in check_iam_permissions
    self.full_name, list(permissions))
  File "gcloud/pubsub/connection.py", line 537, in test_iam_permissions
    resp = conn.api_request(method='POST', path=path, data=wrapped)
  File "gcloud/connection.py", line 343, in api_request
    error_info=method + ' ' + url)
gcloud.exceptions.BadRequest: 400 The IAM operation failed with a non-retryable error: Unknown error. See https://cloud.google.com/pubsub/access_control for more information. (POST https://pubsub.googleapis.com/v1/projects/<MY-PROJECT-ID>/topics/<TOPIC-NAME>:testIamPermissions)

The body of the request looks like so:

{"permissions": ["roles/owner", "roles/editor", "roles/viewer"]}

[tmatsuo]

Oh I see. "roles/owner", "roles/editor", and "roles/viewer" are all roles, not permissions. Can you try the same code with:

{"permissions":
  ["pubsub.topics.attachSubscription", "pubsub.topics.publish", "pubsub.topics.update"]}

or something like that?

[rimey]

I'm new to the IAM APIs, but I wonder if the following might be worth checking just in case:

• Does enabling the "Google Identity and Access Management API" help?
• Does making the service account a project owner help?

Hmm, those were just shots in the dark. You shouldn't need admin permissions to check your permissions. Try @tmatsuo's suggestion first. That's probably it.