Authentication Issue while loading apigee data logs to cloud logging

Google Cloud Apigee
, , ,
1

Hi Team,

We are currently trying to log Apigee data to Google Cloud Logging using the Message Logging policy, which involves service account authentication. Although the service account has been granted the necessary permissions (roles/iam.serviceAccountTokenCreator and roles/logging.logWriter)(Screenshot attached), we are encountering the below error.

ahitankar_0-1726035472149.png
ahitankar_0-1726035472149.png1777Ă—828 55.6 KB

ahitankar_1-1726035488206.png
ahitankar_1-1726035488206.png1753Ă—832 70.6 KB

ahitankar_2-1726035514700.png
ahitankar_2-1726035514700.png1759Ă—700 34.7 KB

The same setup is functioning as expected on our internal Apigee X instance. However, when attempting the same configuration on our client’s Apigee Hybrid instance, it is failing to authenticate, preventing the logs from being uploaded.

Could you please assist us in troubleshooting this issue? Any help or guidance on resolving this discrepancy between Apigee X and Apigee Hybrid would be greatly appreciated.

ahitankar_0-1726034350776.png

2

I wonder if this is because Apigee hybrid also has a runtime Service Account that must have the correct permissions. If you look at this table it says the following for the Apigee hybrid runtime service account:

“Allows the Apigee runtime to generate tokens to authenticate on Google services requested by an API proxy. This service account “impersonates” the proxy-specific service account to make authenticated calls on its behalf.”

Can you grant your Apigee hybrid runtime SA the roles/iam.serviceAccountTokenCreator role and see if that resolves it?

3

Thanks Williamssean. It solved the issue.