Menu
This morning I made a PR which triggered a Cloud Build for my staging enviroment but failed to deploy the results to GAE.
The error was as follows:
ERROR: (gcloud.app.deploy) PERMISSION_DENIED: You do not have permission to act as '[redacted]@appspot.gserviceaccount.com' Step #4: - '@type': type.googleapis.com/google.rpc.ResourceInfo Step #4: description: You do not have permission to act as this service account. Step #4: resourceName: [redacted]@appspot.gserviceaccount.com Step #4: resourceType: serviceAccount
When I look at https://console.cloud.google.com/cloud-build/settings/service-account Cloud build has the follow service account permissions ENABLED:
Checking https://console.cloud.google.com/iam-admin/iam I can see that the cloudbuild service account has the following roles:
401
The caller does not have permission to access projectThis error occurs if the account that you used to deploy your app does not have permission to deploy apps for the current project. To resolve this issue, grant the App Engine Deployer ( roles/appengine. deployer ) role to the account.
Cloud Build does not have permission to access my App Engine instance. To fix this, go into Settings under Cloud Build and enable access to App Engine, and any other cloud service you use in conjunction with Cloud Build. Then wait a moment for the settings to take effect and rerun the build.
[PROJECT-ID]@cloudbuild.gserviceaccount.com is assigned the Cloud Build Service Account Role, and is referred to in the Cloud Build documentation as the service account to which you want to grant additional permissions if you need your builds to perform functions such as deploying to AppEngine or Cloud Functions.
According to the provided error, it seems like you need to add some delegation to your service account. This means that the service account can act on behalf of another service account. Do not add this permission on the project level, since it poses a security risk! Below you can find an example of how to add roles/iam.serviceAccountUser on another service account.
PROJECT_ID=xxxxxx PROJECT_NUMBER=$(gcloud projects list \ --format="value(projectNumber)" \ --filter="projectId=${PROJECT_ID}") gcloud iam service-accounts add-iam-policy-binding \ ${PROJECT_ID}@appspot.gserviceaccount.com \ --member=serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com \ --role=roles/iam.serviceAccountUser \ --project=${PROJECT_ID} To summarize, the service account must have the iam.serviceAccounts.actAs permission, which is included in the roles/iam.serviceAccountUser role. Updated Google documentation can be found here.
72
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
