The above error message is being thrown when I try to add a task to a queue. Here is my setup and the info about this problem:
- Project ID:
my-project - Service Account ID:
my-service-account - Task Queue Name:
my-queue - Task Queue Location:
asia-northeast1(one of the few locations where Cloud Task is currently in beta)
Also, let's confirm that all the above exist and are running.
When I check my service account roles by POSTING to https://cloudresourcemanager.googleapis.com/v1/projects/my-project:getIamPolicy
I receive a response similar to:
{
"status": 200,
"data":
{
"version": 1,
"etag": "BwV6nNWJg4E=",
"bindings": [
{
"role": "roles/cloudtasks.admin",
"members": [
"serviceAccount:my-service-account@my-project.iam.gserviceaccount.com"
]
},
{
"role": "roles/cloudtasks.enqueuer",
"members": [
"serviceAccount:my-service-account@my-project.iam.gserviceaccount.com"
]
}]
}
}
As you can see, my-service-account has the following 2 roles:
- roles/cloudtasks.admin
- roles/cloudtasks.enqueuer
Both of those roles have the cloudtasks.tasks.create permission baked in.
When I try to add a task to the Cloud Task using the following:
POST https://cloudtasks.googleapis.com/v2beta3/projects/my-project/locations/asia-northeast1/queues/my-queue/tasks + task payload
I receive the following error message:
{
"status": 403,
"data":
{
"error":
{
"code": 403,
"message": "The principal (user or service account) lacks IAM permission \"cloudtasks.tasks.create\" for the resource \"projects/my-project/locations/asia-northeast1/queues/my-queue\" (or the resource may not exist).",
"status": "PERMISSION_DENIED"
}
}
}
This really puzzles me.
Is there anybody who knows what I might be doing wrong?