title: cloud spanner IAM permission denied
body: <p>When using the CLI gcloud commands, I can do everything action on my database. Yet when I try to do the same thing from Go (from the same shell instance as I did when using the gcloud commands) I get an error with the message:</p>
  
  <pre><code>spanner: code = "PermissionDenied", desc = "Resource projects/todo/instances/todospanner/databases/tododb is missing IAM permission: spanner.sessions.create."
  </code></pre>
  
  <p>The code I am trying to run is taken from the example found here: <a href="https://cloud.google.com/spanner/docs/getting-started/go/" rel="nofollow noreferrer">https://cloud.google.com/spanner/docs/getting-started/go/</a></p>
  
  <p>I can't find that permission (spanner.session.create) in the spanner permissions either. I've been playing around with setting all permissions I could find related to spanner, on the account which I've used to log in with gcloud.</p>
  
  <p>my GOOGLE_APPLICATION_CREDENTIALS are set and I've also tried with <code>gcloud beta auth</code>. </p>