title: Google Pub Sub "Permission Denied" for project owner account
body: <p>I've been trying to get the Google Pub/Sub Java libraries to work using the Quickstart guides. None of them work as written, at least not for me. I'm working in IntelliJ, Maven framework, OSX, Java 8.</p>
  
  <p>Take <a href="https://cloud.google.com/pubsub/docs/reference/libraries" rel="nofollow noreferrer">this example</a>. I followed all the steps: Created a service account as Project Owner, installed the Gcloud SDK, set my GOOGLE_APPLICATIONS_CREDENTIALS envvar, and found that everything was hunky dory from the command line: I could create topics, publish messages, whatever I wanted.</p>
  
  <p>Then when I tried to run the sample code:</p>
  
  <pre class="lang-java prettyprint-override"><code>import com.google.api.gax.rpc.ApiException;
  import com.google.cloud.ServiceOptions;
  import com.google.cloud.pubsub.v1.TopicAdminClient;
  import com.google.pubsub.v1.ProjectTopicName;
  
  public class CreateTopicExample {
  
    /**
     * Create a topic.
     *
     * @param args topicId
     * @throws Exception exception thrown if operation is unsuccessful
     */
    public static void main(String... args) throws Exception {
  
      // Your Google Cloud Platform project ID
      String projectId = ServiceOptions.getDefaultProjectId();
  
      // Your topic ID, eg. "my-topic"
      String topicId = args[0];
  
      // Create a new topic
      ProjectTopicName topic = ProjectTopicName.of(projectId, topicId);
      try (TopicAdminClient topicAdminClient = TopicAdminClient.create()) {
        topicAdminClient.createTopic(topic);
      } catch (ApiException e) {
        // example : code = ALREADY_EXISTS(409) implies topic already exists
        System.out.print(e.getStatusCode().getCode());
        System.out.print(e.isRetryable());
      }
  
      System.out.printf("Topic %s:%s created.\n", topic.getProject(), topic.getTopic());
    }
  }
  </code></pre>
  
  <p>It throws the ApiException <code>PERMISSION_DENIED</code>. The full stacktrace:</p>
  
  <pre><code>com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: User not authorized to perform this action.
      at com.google.api.gax.rpc.ApiExceptionFactory.createException(ApiExceptionFactory.java:55)
      at com.google.api.gax.grpc.GrpcApiExceptionFactory.create(GrpcApiExceptionFactory.java:72)
      at com.google.api.gax.grpc.GrpcApiExceptionFactory.create(GrpcApiExceptionFactory.java:60)
      at com.google.api.gax.grpc.GrpcExceptionCallable$ExceptionTransformingFuture.onFailure(GrpcExceptionCallable.java:95)
      at com.google.api.core.ApiFutures$1.onFailure(ApiFutures.java:61)
      at com.google.common.util.concurrent.Futures$4.run(Futures.java:1123)
      at com.google.common.util.concurrent.MoreExecutors$DirectExecutor.execute(MoreExecutors.java:435)
      at com.google.common.util.concurrent.AbstractFuture.executeListener(AbstractFuture.java:900)
      at com.google.common.util.concurrent.AbstractFuture.complete(AbstractFuture.java:811)
      at com.google.common.util.concurrent.AbstractFuture.setException(AbstractFuture.java:675)
      at io.grpc.stub.ClientCalls$GrpcFuture.setException(ClientCalls.java:492)
      at io.grpc.stub.ClientCalls$UnaryStreamToFuture.onClose(ClientCalls.java:467)
      at io.grpc.ForwardingClientCallListener.onClose(ForwardingClientCallListener.java:41)
      at io.grpc.internal.CensusStatsModule$StatsClientInterceptor$1$1.onClose(CensusStatsModule.java:684)
      at io.grpc.ForwardingClientCallListener.onClose(ForwardingClientCallListener.java:41)
      at io.grpc.internal.CensusTracingModule$TracingClientInterceptor$1$1.onClose(CensusTracingModule.java:391)
      at io.grpc.internal.ClientCallImpl.closeObserver(ClientCallImpl.java:475)
      at io.grpc.internal.ClientCallImpl.access$300(ClientCallImpl.java:63)
      at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.close(ClientCallImpl.java:557)
      at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.access$600(ClientCallImpl.java:478)
      at io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInContext(ClientCallImpl.java:590)
      at io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37)
      at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:123)
      at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
      at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  Caused by: io.grpc.StatusRuntimeException: PERMISSION_DENIED: User not authorized to perform this action.
      at io.grpc.Status.asRuntimeException(Status.java:526)
      ... 19 more
  </code></pre>
  
  <p>The debugger tells me the <code>projectId</code> is set for the correct default project for that service account, so the service account is connected. And, as I said, I verified from the console that the permissions are in fact set to Project:Owner for that service account. So ... why the permission denied?</p>
  
  <p>Thanks in advance for reading gnarly stack traces on my behalf.</p>