We Keep Coding

unauthorized_client error when trying to impersonate an account

On Google Business Profile API (Google MyBusiness), I am getting following error when I try to impersonate with an email address:
('unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.', {'error': 'unauthorized_client', 'error_description': 'Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.'})
I am trying to achieve this using a Python script which is using Google API Client Library:
file_location = '/some/folder/file.json'
impersonated_email = 'abc#abc.com'
scope = ["https://www.googleapis.com/auth/business.manage"]
credentials = ServiceCredentials.from_service_account_file(file_location, scopes=scope, subject=impersonated_email)
If I try to access the endpoint without using the subject parameter, it is working. But of course the main purpose here is impersonating. And the Google documentation says it is possible to impersonate with the subject parameter (or via with_subject function).
By the way, if I tried some invalid mail address, my error is changing to: ('invalid_grant: Invalid email or User ID', {'error': 'invalid_grant', 'error_description': 'Invalid email or User ID'})
So I assume that I can get the user credentials; but have no idea what could have been wrong.
Does anybody have any idea about the issue? What could be the possible issues?

Well, Google explains that JWT error code like that:
error field: unauthorized_client
error_description field: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.
Meaning:
A service account was authorized using the client email address rather than the client ID (numeric) in the Admin console.
How to resolve:
In the Domain-wide delegation page in the Admin console, remove the client, and re-add it with the numeric ID.
I tried that but I still got the error.
Then, after some digging; I saw that you only can impersonate G-Suite accounts.
So, after that I tried same code with another real-person mail which is a G-Suite account and it worked.

Publish SMS messages through master account in AWS

We have a multi-account setup on AWS. There is a master account and separated accounts for dev, staging and prod. We have enabled sending SMS messages on the master account (exited the SMS sandbox).
I would like now to send sms message through the master account from the dev one. In a standard case, I would just publish a message to the correct ARN (and make sure earlier that proper permissions exist). However, while sending SMS messages, there is no ARN, so I am stuck. Is there a way to achieve it?
For the reference, this is how I can send a message on dev (with the sandbox mode on):
client = boto3.client("sns")
try:
client.publish(
PhoneNumber=recipient,
Message=message,
MessageAttributes={
'AWS.SNS.SMS.SenderID': {
'DataType': 'String',
'StringValue': sender
}
}
)
except botocore.exceptions.ClientError as error: # noqa
logger.error(f'An error occurred while sending SMS message: {error}')
Is there a way to target different account? I was thinking about providing a aws_access_key_id and aws_secret_access_key but maybe there is another way?

You should:
Create an IAM Role in the master account that has permissions to send the SMS message, and a trust policy that allows the IAM Role to be 'assumed' from the child account
Grant permission to the appropriate IAM User or IAM Role in the child account to assume the IAM Role in the master account
The code would then call AssumeRole() to assume the IAM Role from the master account and then use the returned credentials to send the SMS message

How can I send email through python script when my company email is hosted on Google

Just like many big companies using Office365, my company is using google (gsuite) to host their email domain. I need to send automated emails to multiple people within organisation using a python script. How can that be done?

You can use a 3rd party service like Mailgun, it provides a REST API which if you hit you can trigger emails that it will send from a custom domain you configure on the service.
Its super easy to use for python, I use it for Raspberry Pi projects.
def send_simple_message():
return requests.post(
"https://api.mailgun.net/v3/YOUR_DOMAIN_NAME/messages",
auth=("api", "YOUR_API_KEY"),
data={"from": "Excited User <mailgun#YOUR_DOMAIN_NAME>",
"to": ["bar#example.com", "YOU#YOUR_DOMAIN_NAME"],
"subject": "Hello",
"text": "Testing some Mailgun awesomness!"})
It is a nice alternative to using a corporate SMTP server.

Got it fixed.
In order to send an email from Python, we first need to switch ON "Less secure app access" https://myaccount.google.com/lesssecureapps?utm_source=google-account&utm_medium=web.
This we need to do if we don't have 2 Factor Authentication.
If you use 2 Factor Authentication, then you need to create an App Password and use that particular password while sending an email and not your regular password.
To create an App Password use this link: https://support.google.com/mail/answer/185833?hl=en
Now using sample script like below, we can send an email.
import smtplib
# creates SMTP session
s = smtplib.SMTP('smtp.gmail.com', 587)
# start TLS for security
s.starttls()
# Authentication
s.login("username#domain.com", "app_password")
# message to be sent
message = "Message_you_need_to_send"
# sending the mail
s.sendmail("username#domain.com", "recipient#domain.com", message)
# terminating the session
s.quit()

Google provides Gmail api suite for python and it is the preferred way to access versus smtp login/password
You should refer to their developer console for examples and tutorials

Sending mail python webapp2 GAE

I initially tried using the smptlib library but in order to send an e-mail I need to use SSL which costs me with Google App Engine. Other than that, smtplib was a perfect solution.
I found a link here which explains how to send an email using the GAE API.
However, I can't seem to figure out how one would log in to a gmail account say, in order to send the email.
The purpose of this is to send a verification email to addresses of those who are registering. But in the link it shows how to get the current_user and send the email using their credentials. How would I explicitly enter an email, password, and smtp server like I would do with smtplib in order to send the email from my desired address.
Thanks for any answers!

You can't send from an arbitrary email address. As the overview docs state, you can only send from:
The Gmail or Google Apps Account of the user who is currently signed in
Any email address of the form anything#appname.appspotmail.com or anything#appalias.appspotmail.com
Any email address listed in Email API Authorized Senders found in the App Engine Settings page of the Developers Console
If you are the owner of the email account you want to send from, and it is a GMail account, you can add it to the Email API Authorized Senders list from the App Engine console.
Once that's done, you can just use it as the sender address - you don't need to log into anything.

how to have google apps engine send mail- not send a copy of the mail to the sender

I'm using GAE send mail- but I dont want the sender of the mail to get a coppy of the mail.
as for now, when a user is sending mail he gets a mail saying that he sent a mail to someone and the body of the sent mail, how do I disable that?

You can't. Sending email from someone without their knowledge isn't permitted by App Engine.
You can send email from any administrator address; you could add a "donotreply#yourapp.com" type address as an administrator and send email from that address.