Google Drive backup validation [Failed with 403: Forbidden]

Question

When attempting to validate Google Drive remote destination backups, I received the following reason for failure:

reason: "Validation for transport “Google Drive” failed: 
Could not upload test file: 
Error uploading /var/cpanel/backups/tmp.test.32376-1596341845: Forbidden"

What does this failure mean?

Answer

This is an error that we usually get asked about often because the failure message can be quite vague and difficult to understand what the real cause is.

However, the 403 Forbidden failure message will generally be an issue on Google's end that will require the Google account owner to address. Most commonly users encounter this because their Google Drive disk space is no longer sufficient and thus validation or backups fail, however, if this is not the issue, you may review the other possible reasons according to Google.

Google's documentation states that these are the following possible reasons for a 403 error:

• Usage limit exceeded:

  • An error 403 occurs when a quota usage limit has been exceeded
    • To Fix the issue: Increase space available

• Daily limit exceeded:

  • A dailyLimitExceeded error indicates that the courtesy API limit for your project has been reached.
    • To Fix the issue: Request additional quota.

• Number of items in folder:

  • This error occurs when the limit for a folder's number of children (folders, files, and shortcuts) has been exceeded. There is a 500,000 item limit for folders, files, and shortcuts directly in a folder. Items nested in subfolders do not count against this 500,000 item limit.
    • For more information on folder limits, refer to Folder limits in Google Drive.

• User rate limit exceeded:

  • This indicates that the per-user limit has been reached. This limit might be the limit from the API console or a limit from the Drive backend.

    • To fix this error:

      1. Raise the per-user quota in the Developer Console project. For more information, see Request additional quota.
      2. If one user is making a lot of requests on behalf of many users of a G Suite domain, consider a Service Account with authority delegation (setting the quotaUser parameter).
      3. Use exponential backoff to retry the request.

• Rate limit exceeded:

  • The error indicates that the user has reached Google Drive API's maximum request rate.

    • To fix this error:

      1. Batch the requests.
      2. Use exponential backoff to retry the request.

• Sharing rate limit exceeded:

  • The error occurs when the user has reached a sharing limit.

    • To fix this error:

      1. Do not send emails when sharing lot of files.
      2. If one user is making a lot of requests on behalf of many users of a G Suite domain, consider a Service Account with authority delegation to impersonate the owner of each document to share (setting the quotaUser parameter).

• The user has not granted the app {appId} {verb} access:

  • The error occurs when your app is not on the ACL for the file. This error prevents the user from opening the file with your app.

    • To fix this error, perform one of the following operations:

      • Open the Google Drive picker and prompt the user to open the file.
      • Instruct the user to use your app to open the file using the Open with context menu in the Drive UI.

      You can also check the isAppAuthorized field on a file to see if the file was created by or opened with your app.

• The user does not have sufficient permissions for file:

  • The error occurs when the user does not have write access to a file, and your app is attempting to modify that file.
    • To fix this error, instruct the user to contact the file's owner and request edit access.

• App with id {appId} cannot be used within the:

  • A domainPolicy error occurs when the policy for the user's domain doesn't allow access to Google Drive by your app.

    • To fix this error:

      1. Inform the user that the domain doesn't allow your app to access files in Drive.
      2. Instruct the user to contact the domain Admin to request access for your app.