title: How to fix: 403 Error with Google Cloud SQL Export
body: <p>I am attempting to export a full SQL dump of one of our Cloud SQL Postgres instances to Google Cloud Storage so we can have more frequent backups using the <code>google-api-go-client</code> (<a href="https://github.com/googleapis/google-api-go-client" rel="nofollow noreferrer">https://github.com/googleapis/google-api-go-client</a>)</p>
  
  <p>Not matter what I configure, I keep getting this error: <code>panic: googleapi: Error 403: The client is not authorized to make this request., notAuthorized</code> from <code>sqladminService.Instances.Export</code>.</p>
  
  <p>I have a service account configured with the following permissions:</p>
  
  <ul>
  <li>Cloud SQL Admin</li>
  <li>Storage Admin</li>
  <li>Compute Storage Admin (for something else)</li>
  </ul>
  
  <p>The bucket I am exporting to inherits permissions from the Storage Admin role.</p>
  
  <p>Code:
  <code>./k8s/sql.go</code></p>
  
  <pre><code>package gcp
  
  import (
      "fmt"
      "time"
  
      "golang.org/x/net/context"
      "golang.org/x/oauth2/google"
      sqladmin "google.golang.org/api/sqladmin/v1beta4"
  )
  
  type SQLService interface {
      Test(project string) error
  }
  
  type sqlService struct {
      context         context.Context
      sqladminService *sqladmin.Service
  }
  
  func NewSQLService(serviceAccountJSON []byte) (SQLService, error) {
      context := context.Background()
  
      jwtCfg, err := google.JWTConfigFromJSON(serviceAccountJSON, sqladmin.SqlserviceAdminScope, sqladmin.CloudPlatformScope)
      if err != nil {
          return sqlService{}, err
      }
      httpClient := jwtCfg.Client(context)
  
      sqladminService, err := sqladmin.New(httpClient)
      if err != nil {
          return sqlService{}, err
      }
  
      return sqlService{
          context:         context,
          sqladminService: sqladminService,
      }, nil
  }
  
  func (s sqlService) Test(project string) error {
      instance := "REGION:INSTANCE_NAME
  
      storageURI := fmt.Sprintf("gs://BUCKET/FILE-%s.sql.gz", time.Now().Format(time.RFC3339))
      databases := []string{"DATABASE"}
  
      req := &amp;sqladmin.InstancesExportRequest{
          ExportContext: &amp;sqladmin.ExportContext{
              Uri:       storageURI,
              Databases: databases,
          },
      }
  
      _resp, err := s.sqladminService.Instances.Export(project, instance, req).Context(s.context).Do()
      if err != nil {
          return err
      }
  
      return nil
  }
  </code></pre>
  
  <p>Test code:</p>
  
  <pre><code>func Test(cfg config.Config) {
      sql, err := gcp.NewSQLService(cfg.GCPServiceAccountEncodedCreds)
      if err != nil {
          panic(err)
      }
  
      err = sql.Test(cfg.Project)
      if err != nil {
          panic(err)
      }
  }
  </code></pre>
  
  <p>Any help would be appreciated</p>