7

I setup a Cloud Build Trigger in my GCP project in order to deploy a Cloud Function from a Cloud Source Repository via a .yaml file. Everything seems to have been setup correctly and permissions granted according to the official documentation, but when I test the trigger by running it manually, I get the following error:

ERROR: (gcloud.functions.deploy) ResponseError: status=[403], code=[Forbidden], message=[Missing necessary permission iam.serviceAccounts.actAs for on resource [MY_SERVICE_ACCOUNT]. Please grant the roles/iam.serviceAccountUser role. You can do that by running 'gcloud iam service-accounts add-iam-policy-binding [MY_SERVICE_ACCOUNT] --member= --role=roles/iam.serviceAccountUser']

Now first of all, running the suggested command doesn't even work because the suggested syntax is bad (missing a value for "member="). But more importantly, I already added that role to the service account the error message is complaining about. I tried removing it, adding it back, both from the UI and the CLI, and still this error always shows.

Why?

starmandeluxe
  • 2,029
  • 3
  • 22
  • 39

1 Answers1

23

I figured it out after a lot of trial and error. The documentation seems to be incorrect (missing some additional necessary permissions). I used this answer to get me there.

In short, you also need to add the cloudfunctions.developer and iam.serviceAccountUser roles to the [PROJECT_NUMBER]@cloudbuild.gserviceaccount.com account, and (I believe) that the aforementioned cloudbuild service account also needs to be added as a member of the service account that has permissions to deploy your Cloud Function (again shown in the linked SO answer).

The documentation really should be reflecting this.

Good luck!

starmandeluxe
  • 2,029
  • 3
  • 22
  • 39
  • 3
    Thanks for this. Honestly I think google cloud documentation is quite poor. – Madeo Aug 02 '19 at 01:27
  • 2
    Saved my life! This is definitely not clear on the documentation. Even when I tried to do the command suggested on the error message ```gcloud iam service-accounts add-iam-policy-binding {} --member= --role=roles/iam.serviceAccountUser ``` it wouldn't work as this wasn't the real recipient of the required permissions – rlc Aug 12 '19 at 22:05
  • 1
    Thanks, with little documentation was struggling to get a reply from the API, this helped. – Manu Mariaraj Nov 24 '19 at 12:37