gsutil AccessDenied Exception - Login Required in both API Explorer and Service Account - authentication

Question

I am using gsutil with a service account to download a file from a gs bucket. I ran it once an hour ago and it worked without a problem, and then I ran the same code again and I get an AccessDeniedException: 401 Login Required.
To get more information, I run the command with a -D flag, like:
gsutil -D cp gs://mybucket/file localpath
In the debug output, I look at:
Command being run: /path/to/gsutil
config_file_list: /path/to/boto/config
Case 1: Running gsutil under a service account or as another user
I configured a service account using the executable at /path/to/gsutil, not gcloud auth or any other gsutil executable on the machine, using:
/path/to/gsutil config -e
This created a .boto config file in my home directory, $HOME/.boto, which I then moved to another location to refer to by the service.
Since I'm running the service as another user, I need to reference the newly-created .boto file. I set the environment variable BOTO_CONFIG:
BOTO_CONFIG=/path/to/$HOME/.boto
export BOTO_CONFIG
I can confirm that I am referencing the correct config file by looking at the config_file_list variable in the gsutil -D command's output.
To set up the service account, I followed:
https://console.cloud.google.com/permissions/serviceaccounts
The key file from the service account set-up process was downloaded, and the path to it is included during the gsutil config -e step.
However, the response to running the gsutil command from the service account is AccessDeniedException: 401 Login Required.
Case 2: API Explorer
On further exploration, I used the web-based API explorer storage.objects.get at:
https://developers.google.com/apis-explorer/#p/storage/v1/storage.objects.get
to get the object's "mediaLink". When I click the mediaLink, I still receive a response that says "Login Required", despite being logged into my google account on the browser.
Why am I receiving the above "Login Required" responses in both cases, when I have set up the service account as instructed in Case 1, and am logged into the API explorer in Case 2?

Answer 1

I was able to solve this problem by looking at the read permissions on the .boto file. The file that was created by
gsutil config -e
only had read permissions set for the current user. Since it was being read by a service running as a different user, it wasn't able to read the file and yielding a 401 Login Required error. I fixed it by adding read permissions for the service's group.
In the least sophisticated case, you could fix it by giving any user read permission with
chmod a+r .boto