When submitting a Cloud Build run via gcloud builds submit ... I'm getting a forbidden error saying I don't have access to the bucket(s). There are 2 places where buckets are normally involved in submitting a Cloud Build, the staging and logs bucket. I specified the buckets for each as buckets (the same one, just different folders) that I do have access too so the command looks like this:
gcloud builds submit
--gcs-log-dir $my_bucket/logs
--gcs-source-staging-dir $my_bucket/source
The error I get is:
ERROR: (gcloud.builds.submit) 403: The user is forbidden from accessing the bucket [$my_bucket]: Please check your organization's policy.
I re-ran with --log-http and --verbosity debug and the expanded error shows the real reason:
DEBUG: https://storageapis.google.com "GET /storage/v1/b/$my_bucket?alt=json"
...
{
"error": {
"code": 403,
"message": "$user does not have serviceusage.services.use access to the Google Cloud Project."
}
}
I did some digging and see that's this error shows up when supplying a quota/billing project with the request (in addition to not having service consumer role). I confirmed this when inspecting the request's HTTP headers which included X-Goog-User-Project: $my_project.
What's weird is that I have access to objects in this bucket and can run gsutil/HTTP commands just fine which are using the same API endpoints with the difference being that gsutil doesn't include that user project in the request.
Is there a way to submit a build that doesn't include the project so that I don't need serviceusage.services.use permission? I tried unsetting the project in my gcloud config but it prompted me that I needed to either set it or pass it with --project flag.
edit: the bucket isn't "requester pays" enabled either which is why gsutil and client libraries work fine