# GCS Repository creation Issue

**URL:** <https://discuss.elastic.co/t/gcs-repository-creation-issue/109070>\
**Category:** Elasticsearch\
**Created:** [November 24, 2017, 6:03pm UTC](https://discuss.elastic.co/t/gcs-repository-creation-issue/109070 "2017-11-24T18:03:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hanish\_Bansal](https://avatars.discourse-cdn.com/v4/letter/h/e36b37/32.png) [@Hanish\_Bansal](https://discuss.elastic.co/u/Hanish_Bansal)\
**Post date:** [November 24, 2017, 6:03pm UTC](https://discuss.elastic.co/t/gcs-repository-creation-issue/109070/1 "2017-11-24T18:03:02Z")

</div>

Hi,

We have recently upgraded our ES version from 5.6 to 6.0. After that we are facing issue in taking snapshot of data.

In 6.0 ES, service.account option from repository has been removed so we need to add authentication key in elastic keystore.

We have added GCS authentication key on all servers via below command-

```
cat /opt/elasticsearch-6.0.0/config/gcs-secure-52144da29c6e.json | /opt/elasticsearch-6.0.0/bin/elasticsearch-keystore add gcs.account

```

Then we tried to create repository using below command:

```
PUT /_snapshot/gcs_repository_new?pretty
{
  "type": "gcs",
  "settings": {
     "bucket": "my-bucket",
     "client": "gcs.account"
  }
}

```

It is giving below error:

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "repository_verification_exception",
        "reason": "[gcs_repository_new] path is not accessible on master node"
      }
    ],
    "type": "repository_verification_exception",
    "reason": "[gcs_repository_new] path is not accessible on master node",
    "caused_by": {
      "type": "i_o_exception",
      "reason": "403 Forbidden\n{\n \"code\" : 403,\n \"errors\" : [{\n \"domain\" : \"global\",\n \"message\" : \"Insufficient Permission\",\n \"reason\" : \"insufficientPermissions\"\n }],\n \"message\" : \"Insufficient Permission\"\n}"
    }
  },
  "status": 500
}

```

It would be great help if anyone can share suggestions to resolve this issue.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 24, 2017, 8:30pm UTC](https://discuss.elastic.co/t/gcs-repository-creation-issue/109070/2 "2017-11-24T20:30:24Z")

</div>

Actually I don't understand. Are you running this from GCE instance?

If so, you just need to follow: [https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-gcs-usage.html#repository-gcs-using-compute-engine](https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-gcs-usage.html#repository-gcs-using-compute-engine)

Which means that you don't need to set `client`

If not, then you need to follow this: [https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-gcs-usage.html#repository-gcs-using-service-account](https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-gcs-usage.html#repository-gcs-using-service-account)

`gcs.client.NAME.credentials_file` is the thing you need to define.

And then define `"client": "NAME"`.

Can you clarify what you are doing?

---

<div class="post-metadata">

**Author:** ![Hanish\_Bansal](https://avatars.discourse-cdn.com/v4/letter/h/e36b37/32.png) [@Hanish\_Bansal](https://discuss.elastic.co/u/Hanish_Bansal)\
**Post date:** [November 25, 2017, 2:28am UTC](https://discuss.elastic.co/t/gcs-repository-creation-issue/109070/3 "2017-11-25T02:28:46Z")

</div>

We are running everything from GCE instances but I was not aware that it can use built in Google authentication to access the storage so till now we were using service account mechanism to take data snapshots till ElasticSearch version 5.6.x.

I just checked about my GCE instances if they are configured with Read/Write access to storage or not. Unfortunately all instances are created with only READ access so we won't be able to use built in authentication mechanism.

Reg service account mechanism:  
Where we need to define this setting gcs.client.NAME.credentials\_file ?  
We added credential file using elastic-keystore tool of ES as defined in mail trail. Then we created repository using client option but thrown an error of "path is not accessible".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2017, 2:28am UTC](https://discuss.elastic.co/t/gcs-repository-creation-issue/109070/4 "2017-12-23T02:28:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.