Unable to delete Google Cloud Storage object change notification webhook - google-cloud-storage

Question

I created a webhook to monitor changes on a bucket in 2015 using the command gsutil notification watchbucket https://my-project.appspot.com/myWebHook gs://my-bucket/
Today I would like to delete it but I'm unable to do it.
gsutil notification list -o gs://my-bucket/ is showing me the current webhooks
It is returning something like that:
Notification channel 1:
Channel identifier: someid-905e-905e-905e-1fdca170d689
Resource identifier: myIdentifierXXXfncnI0SuU-U
Application URL: url=https://my-project.appspot.com/myWebHook&appEngine=true
Created by:
Creation time: 2015-09-08 11:44:26.775000
when I try to delete it with the command gsutil notification stopchannel someid-905e-905e-905e-1fdca170d689 myIdentifierXXXfncnI0SuU-U
I get this:
NotFoundException: 404 Channel 'someid-905e-905e-905e-1fdca170d689' not found for project '32555940559'
All this is done with my account which is the owner of the project. By the way, the id of the project in the error message is not the one of my project 🤔
If I switch to a service account, I get a different error: AccessDeniedException: 403 Caller not owner of subscription
Do you have any idea how I could solve this?

Answer 1

According to the official documentation Object change notification:
There are three steps to configuring authorization in an object change
notification scenario:
1.Creating a Service Account
2.Configuring gsutil to Use the Service Account
3.Identifying a Domain to Receive Notifications
To be able to remove the notification channel you have to identify the service account used for creating the channel (owner service account of this channel). Then, you have to configure gsutil to use that specific service account and remove the notification channel. Therefore, trying to perform this action by authorizing gsutil using your personal account will not work.

Answer 2

I was getting this same problem and solved it by authenticating gcloud with my main default service account (this may have been the account used when creating the watcher):
gcloud auth activate-service-account my-project#appspot.gserviceaccount.com --key-file ~/Downloads/my-project-1234abcdef.json
I could then list all my watchers to get the Channel ID and Resource ID with
gsutil notification list -o gs://my-project.appspot.com/
Note that in this next command, I couldn't use the bucket path like gs://my-project.appspot.com/ but rather had to use the goofy "Resource identifier" value from the list response above which looks like
Bucket my-project.appspot.com has the following active Object Change Notifications:
Notification channel 1:
Channel identifier: prod
Resource identifier: asdf1234
Application URL: url=https://my-project.appspot.com/api/gcs&appEngine=true
Created by:
Creation time: 2019-02-11 16:16:07.955000
Notification channel 2:
Channel identifier: dev
Resource identifier: 1234asdf
Application URL: url=https://my-project.appspot.com/api/gcs&appEngine=true
Created by:
Creation time: 2019-02-11 16:21:40.864000
This command then removed the prod channel:
gsutil notification stopchannel prod asdf1234
Removing channel prod with resource identifier asdf1234 ...
Succesfully removed channel.