1

When I run this in cmd line:

gcloud builds submit --tag "gcr.io/<project id>/<cloudrun app name>"

I get this error:

ERROR: (gcloud.builds.submit) HTTPError 403: <?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>[service accoun name]@[project-id].iam.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object.</Details></Error>

Here are the roles I've assigned to the Service account (yes, its overkill, just trying to get it to work):

enter image description here

I've tried these solutions, but they haven't worked:

What am I doing wrong?

Saigeetha Sundar
  • 144
  • 5
ranni rabadi
  • 194
  • 2
  • 9

3 Answers3

4

Hello I had the same issue. Solved it by adding the role "Viewer" to my service account as explained here : https://github.com/google-github-actions/setup-gcloud/issues/105

bourliam
  • 41
  • 2
  • 1
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – Ran Marciano Mar 02 '21 at 11:42
  • I can't find a role just called "Viewer". Can you please be more precise @bourliam ? What exact "Viewer" role did assign? – xetra11 Jul 07 '21 at 16:11
1

Could you please confirm that you are using the default service account to trigger your build? If you are using a different service account to trigger the build, use the similar role which your default service account has as well.

Make sure you have the following roles for the service account:

  1. Cloud Build Service account
  2. Service Account User
  3. Cloud Run Admin

You can change the permissions from the Cloud Build Settings page.

Then try running your builds again.

Saigeetha Sundar
  • 144
  • 5
  • This didn't work. I created a new service account with the permissions you have described, still gave me the same error. – ranni rabadi Jan 26 '21 at 05:24
0

Have you tried creating a new service with a prebuilt demo container from the web console like described here?

We got the same error ("... does not have storage.objects.get access ...") initially, but it worked once we created a first demo service using the Google Cloud Console.

Klemens Zleptnig
  • 1,698
  • 20
  • 36