GCP Cloud function custom sql bigquery fails with "User does not have bigquery.jobs.create permission in project"

Explanation of GCP setup:

pubsub topic -> cloud function -> biquery (custom update query).

I have pubsub topic with push subscription which is executing Cloud Function. Function is trying to perform UPDATE in bigquery table with .query() method of bigquery client.

Cloud Function source:

const {BigQuery} = require('@google-cloud/bigquery');

exports.update_user = (event, context) => {
  const bigqueryClient = new BigQuery();
  bigqueryClient.query({
    query: 'UPDATE `gcp-project.dataset-name.table-name` SET user.first_name = \'First name\' WHERE tracking_id = \'360779f4-f77a-4877-94da-85459b1db219\''
  });
};

So its super simple function just for testing purposes. I'm getting following error in function logs:

Exception from a finished function: Error: Access Denied: Project gcp-project: User does not have bigquery.jobs.create permission in project gcp-project.

Service account is used by client code only on connection to pubsub for push message to topic and this service account has role with following permissions:

• bigquery.datasets.create
• bigquery.datasets.get
• bigquery.jobs.create
• bigquery.tables.create
• bigquery.tables.get
• bigquery.tables.updateData
• pubsub.topics.publish
• storage.objects.create
• storage.objects.delete
• storage.objects.get

Important note: I have different pubsub topic with pretty much same setup which is performing INSERT into bigquery (same table, same service account, same gcp project). These inserts are working just fine.

2 questions:

1. when cloud function is executed in that setup which gcp (service) account is being used (service account which was used for push message into pubsub topic, account which was used for creating cloud function or maybe some else) ?
2. I lost all clues why that function fails during update. anyone cloud help ?