Serverless GCP Function deployment

user_7730954 0
Viewed 316

I am trying to deploy the GCP Cloud Function using serverless node module. while I have followed the instructions from site but still I am facing following error.

Serverless: Packaging service...
Serverless: Excluding development dependencies...
Serverless: Injecting required Python packages to package...
Serverless: Compiling function "ProductVersion"...
Serverless: Uploading artifacts...
Serverless: Artifacts successfully uploaded...
Serverless: Updating deployment...
Serverless: Checking deployment update progress...
. 
 Error ---------------------------------------------------
 
  Error: Deployment failed: RESOURCE_ERROR
  
       {"ResourceType":"gcp-types/cloudfunctions-v1:projects.locations.functions","ResourceErrorCode":"403","ResourceErrorMessage":{"code":403,"message":"Permission 'cloudfunctions.functions.create' denied on resource 'projects/123456/locations/us-central1/functions/demeter-dev-ProductVersion' (or resource may not exist).","status":"PERMISSION_DENIED","statusMessage":"Forbidden","requestPath":"https://cloudfunctions.googleapis.com/v1/projects/123456/locations/us-central1/functions","httpMethod":"POST"}}
      at throwErrorIfDeploymentFails (/home/demo/workspace/demo/demeter/node_modules/serverless-google-cloudfunctions/shared/monitorDeployment.js:71:11)
      at provider.request.then (/home/demo/workspace/demo/demeter/node_modules/serverless-google-cloudfunctions/shared/monitorDeployment.js:42:17)
      at process._tickCallback (internal/process/next_tick.js:68:7)

I have configured my GCP Service account with following permission which required but it is still not working.

1.Cloud Functions Admin

2.Cloud Functions developer

3.Deployment manager editor

4.logging admin

5.storage admin

Here is my serverless.yml file

service: demo

package:
  exclude:
    - node_modules/**
    - .gitignore
    - .git/**
    - .idea/**

plugins:
  - serverless-google-cloudfunctions
  - serverless-python-requirements
  - serverless-prune-plugin

provider:
  name: google
  runtime: python37
  project: 123456
  credentials: ./cred.json # path must be absolute

functions:
  ProductVersion:
    handler: get_pronto_app_version
    events:
      - http: path

Can anyone please help me out

google-cloud-functions serverless serverless-framework google-cloud-platform python
3 Answers

The 403 Forbidden is related to the user or service account who is deploying the function. You will need to have at least the roles/cloudfunctions.developer in order to be able to deploy a Cloud Function.

Also, you must also assign the user the Service Account User IAM role (roles/iam.serviceAccountUser) on the Cloud Functions Runtime service account.

Ref: https://cloud.google.com/functions/docs/reference/iam/roles#additional-configuration

user_60353120

The third party application use ADC (Application Default Credential). It could be (by order of precedence):

  1. A service account key file, with the path of the file set in the GOOGLE_APPLICATION_CREDENTIALS environment variable.
  2. The metadata server (only applicable on Google Cloud environment)
  3. The well known location where credentials are stored.

The 1. isn't a good practice, and I don't recommend it. The 2. is impossible on your workstation. The 3. is the best: perform a gcloud auth application-default login to create the credential file and try again.

user_113725930

It got resolved by changing the project variable in serverless.yml file I was mentioning the numeric id but it was expecting the alphanumeric id of the project that we see on the dashboard of GCP. Somehow it was not throwing the exact error but after wasting lots of time in it got resolved.

project: myproject12

Thanks everyone for answering this question.

user_77309540
Related