{"record":{"id":"f7e7f2136748dac1","repo":"apache/beam","slug":"unable-to-determine-the-owner-of-the-default-bucket-at-gs","errorCode":null,"errorMessage":"Unable to determine the owner of the default bucket at gs://${bucketName}","messagePattern":"Unable to determine the owner of the default bucket at gs://(.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/options/GcpOptions.java","lineNumber":506,"sourceCode":"      try {\n        gcsOptions.getGcsUtil().createBucket(gcsOptions.getProject(), bucket);\n      } catch (FileAlreadyExistsException e) {\n        LOG.debug(\"Bucket '{}'' already exists, verifying access.\", bucketName);\n      } catch (IOException e) {\n        throw new RuntimeException(\"Unable create default bucket.\", e);\n      }\n\n      // Once the bucket is expected to exist, verify that it is correctly owned\n      // by the project executing the job.\n      try {\n        long owner = gcsOptions.getGcsUtil().bucketOwner(GcsPath.fromComponents(bucketName, \"\"));\n        checkArgument(\n            owner == projectNumber,\n            \"Bucket owner does not match the project from --project:\" + \" %s vs. %s\",\n            owner,\n            projectNumber);\n      } catch (IOException e) {\n        throw new RuntimeException(\n            \"Unable to determine the owner of the default bucket at gs://\" + bucketName, e);\n      }\n      return \"gs://\" + bucketName + \"/temp/\";\n    }\n\n    /**\n     * Returns the project number or throws an exception if the project does not exist or has other\n     * access exceptions.\n     */\n    private static long getProjectNumber(String projectId, CloudResourceManager crmClient)\n        throws IOException {\n      return getProjectNumber(\n          projectId,\n          crmClient,\n          BackOffAdapter.toGcpBackOff(BACKOFF_FACTORY.backoff()),\n          Sleeper.DEFAULT);\n    }\n","sourceCodeStart":488,"sourceCodeEnd":524,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/options/GcpOptions.java#L488-L524","documentation":"After ensuring the default bucket exists, tryCreateDefaultBucketWithPrefix calls GcsUtil.bucketOwner to verify ownership; IOException is wrapped as RuntimeException 'Unable to determine the owner of the default bucket at gs://<bucketName>'. The library could not read bucket metadata to confirm the bucket belongs to the current project.","triggerScenarios":"Immediately after createBucket (or when it already existed), bucketOwner(GcsPath) throws IOException: storage.buckets.get permission denied, bucket deleted in a race, requester-pays bucket, or transient API failure.","commonSituations":"Service account can create but not view buckets (missing storage.buckets.get); bucket created by another project with the same derived name; transient GCS 5xx.","solutions":["Grant storage.buckets.get (roles/storage.legacyBucketOwner or roles/storage.objectAdmin+bucket get) to the identity","Set an explicit --tempLocation bucket you own to skip the ownership probe","Retry on transient failures; check GCS status dashboard","Confirm the bucket was not removed concurrently"],"exampleFix":"// before\n// default bucket, service account lacks bucket get\n// after\ngsutil iam ch serviceAccount:sa@project.iam.gserviceaccount.com:roles/storage.admin gs://bucket","handlingStrategy":"retry","validationCode":"// pre-check ownership with gsutil or GCS API before relying on default bucket\n// gsutil bucket-policy-only / get-IAM-policy, or Storage.buckets.get(bucket) via client","typeGuard":null,"tryCatchPattern":"try {\n  String b = gcpOptions.getDefaultBucketName();\n} catch (RuntimeException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"Unable to determine the owner\")) {\n    // retry once after backoff, then fall back to explicit tempLocation\n    gcpOptions.setTempLocation(\"gs://owned-bucket/temp/\");\n  } else throw e;\n}","preventionTips":["Grant the identity storage.buckets.get on auto-created buckets","Prefer an explicit, pre-owned --tempLocation bucket","Avoid concurrent pipelines racing on the same derived bucket name","Retry on transient GCS 5xx"],"tags":["gcp","gcs","permissions","storage","java"],"backgroundTag":"permission-denied","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}