can't download blob from Google Vault API export

Question

I can't get this to work either. In the Google API example documentation, it states this, see below. I am able to authenticate using a storage account, and access the Bucket and see the blobs, but if I use any kind of a blob method, e.g., blob.exists() or blob.download_from_filename(), it gets a forbidden 403 error. I have added storage admin privileges to both the user account that is authenticated and the service account, but still get this error. The documentation below doesn't mention anything about using a service account to access the blob. But, I don't know how to instantiate a storage client with the user account instead of a service account. Does anyone have an example of this ?

def download_exports(service, matter_id):
#"""Google Cloud storage service is authenticated by running
#`gcloud auth application-default login` and expects a billing enabled project
#in ENV variable `GOOGLE_CLOUD_PROJECT` """
gcpClient = storage.Client()
matter_id = os.environ['MATTERID']
for export in vaultService.matters().exports().list(
      matterId=matter_id).execute()['exports']:
    if 'cloudStorageSink' in export:
      directory = export['name']
      if not os.path.exists(directory):
       os.makedirs(directory)
      print(export['id'])
  for sinkFile in export['cloudStorageSink']['files']:
    filename = '%s/%s' % (directory, sinkFile['objectName'].split('/')[-1])
    objectURI = 'gs://%s/%s' % (sinkFile['bucketName'],
                                sinkFile['objectName'])
    print('get %s to %s' % (objectURI, filename))
    gcpClient.download_blob_to_file(objectURI, open(filename, 'wb+'))

Answer 1

O.K., I figured out the problem. I worked around this by using the default storage service account, instead of creating a new service account.

    #use the default service account       
    gcpClient = storage.Client()