I am writing a GitHub Action to deploy my application to GCP's "Cloud Run" service.
name: Deploy to production
on:
push:
branches:
- master
env:
PROJECT_ID: XXX
SERVICE_NAME: XXX
RUN_REGION: XXX
PACKAGE_VERSION : XXX
permissions:
contents: read
id-token: write
jobs:
deployment-job:
runs-on: ubuntu-latest
environment: production
steps:
- uses: actions/checkout@v2
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@v0
with:
workload_identity_provider: XXX
service_account: XXX
- name: Deploy to Cloud Run
uses: google-github-actions/deploy-cloudrun@v0
with:
service: ${{ env.SERVICE_NAME }}
source: gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ env.PACKAGE_VERSION }} # equivalent to "gcloud builds submit ..."
region: ${{ env.RUN_REGION }}
tag: ${{ env.PACKAGE_VERSION }}
I run into this error :
ERROR: (gcloud.beta.run.deploy) The user is forbidden from accessing the bucket [XXX]. Please check your organization's policy or if the user has the "serviceusage.services.use" permission
I tried to add this permission to my service account but I am still running on the same error :
gcloud projects add-iam-policy-binding XXX --member=serviceAccount:XXX --role=roles/serviceusage.serviceUsageAdmin
I set up the Workload Identity Federation from this tutorial.