service account permission issue while deploying cloud function

user_15432255 0
Viewed 111

I have service account SA1 which is created in project1 with permission ( cloud function invoker, service account user ). i want to deploy a cloud function CF1 in project2 and specify SA1 in that cloud function as SERVICE_ACCOUNT parameter. while deploying CF1 in project2 i am getting below error even though "service account user" permission exist for this SA1 in project 1 and
SA1 is also added in project 2

ERROR: (gcloud.functions.deploy) ResponseError: status=[403], code=[Ok], message=[Missing necessary permission iam.serviceAccounts.act As for cloud-functions-mixer on the service account SA1. Grant the role 'roles/iam.serviceAccountUser' to cloud-functions-mixer on the service account SA1.

google-cloud-iam google-cloud-platform
1 Answers

It's absolutely not clear and it's a great question!

You need 2 things

  • Firstly, run the proposed command
gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT --member=cloud-functions-mixer --role=roles/iam.serviceAccountUser

BUT what is that cloud-functions-mixer?? In fact, it's only the account that runs the command

#for you
gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT --member=user:<your email> --role=roles/iam.serviceAccountUser

# for a service account (CI/CD pipeline for instance)
gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT --member=serviceAccount:<service account email> --role=roles/iam.serviceAccountUser
  • Then activate the cross-project project usage, deactivated by default. You can achieve that only if you have an organisation. If you haven't, you can't go to organisation policies
    • Go to Organization policies
    • Look for Disable Cross-Project Service Account Usage
    • Edit, click on customize and add rule to disable the rule enter image description here
user_113725930
Related