Use the OAuth scope that is required for storage.objects.update.

ubschmidt2 · ubschmidt2 · commit 2a7c09de76d0 · 2018-06-22T15:31:07.000+02:00
diff --git a/backend/remote-state/gcs/backend.go b/backend/remote-state/gcs/backend.go
@@ -147,13 +147,13 @@ func (b *gcsBackend) configure(ctx context.Context) error {
 		conf := jwt.Config{
 			Email:      account.ClientEmail,
 			PrivateKey: []byte(account.PrivateKey),
-			Scopes:     []string{storage.ScopeReadWrite},
+			Scopes:     []string{storage.ScopeFullControl},
 			TokenURL:   "https://accounts.google.com/o/oauth2/token",
 		}
 
 		opts = append(opts, option.WithHTTPClient(conf.Client(ctx)))
 	} else {
-		opts = append(opts, option.WithScopes(storage.ScopeReadWrite))
+		opts = append(opts, option.WithScopes(storage.ScopeFullControl))
 	}
 
 	opts = append(opts, option.WithUserAgent(httpclient.UserAgentString()))

Original file line number	Diff line number	Diff line change
`@@ -147,13 +147,13 @@ func (b *gcsBackend) configure(ctx context.Context) error {`
`147`	`147`	`conf := jwt.Config{`
`148`	`148`	`Email: account.ClientEmail,`
`149`	`149`	`PrivateKey: []byte(account.PrivateKey),`
`150`		`- Scopes: []string{storage.ScopeReadWrite},`
	`150`	`+ Scopes: []string{storage.ScopeFullControl},`
`151`	`151`	`TokenURL: "https://accounts.google.com/o/oauth2/token",`
`152`	`152`	`}`
`153`	`153`
`154`	`154`	`opts = append(opts, option.WithHTTPClient(conf.Client(ctx)))`
`155`	`155`	`} else {`
`156`		`- opts = append(opts, option.WithScopes(storage.ScopeReadWrite))`
	`156`	`+ opts = append(opts, option.WithScopes(storage.ScopeFullControl))`
`157`	`157`	`}`
`158`	`158`
`159`	`159`	`opts = append(opts, option.WithUserAgent(httpclient.UserAgentString()))`