[COST-5887] - add handling for GCP Forbidden exception (#5518)

koku/providers/gcp/provider.py

@@ -2,6 +2,7 @@
 import logging
 
 import google.auth
+from google.api_core.exceptions import Forbidden
 from google.auth.exceptions import RefreshError
 from google.cloud import bigquery
 from google.cloud import storage
@@ -94,6 +95,10 @@ def _detect_billing_export_table(self, data_source, credentials):
                 f"Unable to find dataset: {data_source.get('dataset')} in project: {credentials.get('project_id')}"
             )
             raise serializers.ValidationError(error_obj(key, message))
+        except Forbidden as err:
+            key = "authentication.project_id"
+            message = f"403 forbidden error. {err.message}"
+            raise serializers.ValidationError(error_obj(key, message))
         except BadRequest as e:
             LOG.warning(str(e))
             key = "billing_source"

koku/providers/test/gcp/test_provider.py

@@ -6,6 +6,7 @@
 
 from django.test import TestCase
 from faker import Faker
+from google.api_core.exceptions import Forbidden
 from google.auth.exceptions import RefreshError
 from google.cloud.exceptions import BadRequest
 from google.cloud.exceptions import GoogleCloudError
@@ -222,6 +223,17 @@ def test_cost_usage_source_is_reachable_no_table_id_notready(self, mock_auth, mo
         with self.assertRaises(SkipStatusPush):
             provider.cost_usage_source_is_reachable(credentials_param, billing_source_param)
 
+    @patch("providers.gcp.provider.GCPProvider.get_table_id")
+    def test_detect_billing_export_table_forbidden(self, mock_get_table):
+        """Verify forbidden error is raised."""
+        err_msg = "GCP Error"
+        mock_get_table.side_effect = Forbidden(err_msg)
+        provider = GCPProvider()
+        billing = {"dataset": FAKE.word()}
+        creds = {"project_id": FAKE.word()}
+        with self.assertRaises(ValidationError):
+            provider._detect_billing_export_table(billing, creds)
+
     @patch("providers.gcp.provider.bigquery")
     @patch("providers.gcp.provider.discovery")
     @patch("providers.gcp.provider.google.auth.default")