Firestore getSignedUrl() give The caller does not have permission at Gaxios

I got following error at file.getSignedUrl. I have other function to copy the file and create new file on Cloud Storage. Why this function need permission and where do I need to set?

Error: The caller does not have permission at Gaxios._request (/layers/google.nodejs.yarn/yarn_modules/node_modules/gaxios/build/src/gaxios.js:129:23) at runMicrotasks () at processTicksAndRejections (node:internal/process/task_queues:96:5) at async Compute.requestAsync (/layers/google.nodejs.yarn/yarn_modules/node_modules/google-auth-library/build/src/auth/oauth2client.js:368:18) at async GoogleAuth.signBlob (/layers/google.nodejs.yarn/yarn_modules/node_modules/google-auth-library/build/src/auth/googleauth.js:662:21) at async sign (/layers/google.nodejs.yarn/yarn_modules/node_modules/@google-cloud/storage/build/src/signer.js:103:35) { name: 'SigningError' }

const functions = require("firebase-functions");
const axios = require("axios");
const { Storage } = require("@google-cloud/storage");

const storage = new Storage();

// Don't forget to replace with your bucket name
const bucket = storage.bucket("projectid.appspot.com");

async function getAlbums() {
  const endpoint = "https://api.mydomain.com/graphql";
  const headers = {
    "content-type": "application/json",
  };

  const graphqlQuery = {
    query: `query Albums {
        albums {
          id
          album_cover
        }
      }`,
   };
  const response = await axios({
    url: endpoint,
    method: "post",
    headers: headers,
    data: graphqlQuery,
  });

  if (response.errors) {
    functions.logger.error("API ERROR : ", response.errors); // errors if any
  } else {
    return response.data.data.albums;
  }
}

async function updateUrl(id, url) {
  const endpoint = "https://api.mydomain.com/graphql";
  const headers = {
    "content-type": "application/json",
  };

  const graphqlQuery = {
    query: `mutation UpdateAlbum($data: AlbumUpdateInput!, $where: 
AlbumWhereUniqueInput!) {
    updateAlbum(data: $data, where: $where) {
      id
    }
  }`,
variables: {
  data: {
    album_cover: {
      set: url,
    },
  },
  where: {
    id: id,
  },
},
  };
  const response = await axios({
    url: endpoint,
    method: "post",
    headers: headers,
    data: graphqlQuery,
  });

  if (response.errors) {
    functions.logger.error("API ERROR : ", response.errors); // errors if any
  } else {
    return response.data.data.album;
  }
}

const triggerBucketEvent = async () => {
  const config = {
    action: "read",
    expires: "03-17-2025",
  };

  const albums = await getAlbums();

  albums.map((album) => {
    const resizedFileName = album.id + "_300x200.webp";
    const filePath = "images/albums/thumbs/" + resizedFileName;
    const file = bucket.file(filePath);
    functions.logger.info(file.name);
    file.getSignedUrl(config, function (err, url) {
      if (err) {
        functions.logger.error(err);
        return;
      } else {
        functions.logger.info(
          `The signed url for ${resizedFileName} is ${url}.`
        );
        updateUrl(album.id, url);
      }
    } );
  });
};

exports.updateResizedImageUrl = functions.https.onRequest(async () => {
  await triggerBucketEvent();
});