IAM permission 'dialogflow.conversations.create' on 'projects/xxx' denied.

[PratheepCXM]

I am Using Dialogflow GRPC API CreateConversation, but the API returns the above IAM Permission error. I am using Service Account as credentials. But the same JSON file is working in JAVA and C++ client libraries. What permission/Role needs to be given in IAM to create conversation. I have used grpc::GoogleDefaultCredentials(). Do I need to give any other credentials? I am testing using dialogflow V2 API.

[coryan]

I am Using Dialogflow GRPC API CreateConversation, but the API returns the above IAM Permission error. I am using Service Account as credentials. But the same JSON file is working in JAVA and C++ client libraries.

I am a bit confused. Are you saying these credentials work in Java but not in C++? Or if they work in both, what is the problem?

What permission/Role needs to be given in IAM to create conversation. I have used grpc::GoogleDefaultCredentials(). Do I need to give any other credentials?

Hmmm... maybe you are trying to make the calls via gRPC, without using the C++ client library?

There is a small chance that I guessed correctly as to what the problem is, and in that case maybe the following helps. Please ignore it if it just confuses things or you already know this stuff (both likely):

grpc::GoogleDefaultCredentials() solves the authentication problem ("what principal is making the RPC"), the authorization problem ("is this principal authorized to make that RPC") is solved by IAM. Whether you need to use other credentials depends on whether the default credentials represent the principal that you want to make the RPC.

To understand exactly what you get with grpc::GoogleDefaultCredentials() I think https://google.aip.dev/auth/4110 may be a good start.
The summary is that you are using the credentials associated with your VM (or your workload if using GKE or something similar), unless you set GOOGLE_APPLICATION_CREDENTAILS.

Assuming you are using the desired principal, then you need to check if the principal has the right permissions. For dialogflow these seem to be good places to start:

https://cloud.google.com/dialogflow/cx/docs/concept/access-control#iam-roles

https://cloud.google.com/iam/docs/understanding-roles#dialogflow-roles