CODEWITHSUNDEEP
node.jsgoogle-app-enginegoogle-cloud-platformgoogle-cloud-tasks
Dominic
Dominic

Reputation: 3483

Roles for queue.yaml deployment with service account

I'm trying to deploy our app.yaml and queue.yaml using the following command:

gcloud --verbosity=debug --project PROJECT_ID app deploy app.yaml queue.yaml

I created a new service account with the roles

for deploying the app.yaml, which works by itself. When trying to deploy the queue.yaml, I get the following error:

DEBUG: Running [gcloud.app.deploy] with arguments: [--project: "PROJECT_ID", --verbosity: "debug", DEPLOYABLES:1: "[u'queue.yaml']"]
DEBUG: Loading runtimes experiment config from [gs://runtime-builders/experiments.yaml]
INFO: Reading [<googlecloudsdk.api_lib.storage.storage_util.ObjectReference object at 0x7fcc7dba0dd0>]
DEBUG: API endpoint: [https://appengine.googleapis.com/], API version: [v1]
Configurations to update:

descriptor:      [/home/dominic/workspace/PROJECT/api/queue.yaml]
type:            [task queues]
target project:  [PROJECT_ID]


DEBUG: (gcloud.app.deploy) PERMISSION_DENIED: The caller does not have permission
Traceback (most recent call last):
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 983, in Execute
    resources = calliope_command.Run(cli=self, args=args)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 807, in Run
    resources = command_instance.Run(args)
  File "/usr/lib/google-cloud-sdk/lib/surface/app/deploy.py", line 117, in Run
    default_strategy=flex_image_build_option_default))
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/command_lib/app/deploy_util.py", line 606, in RunDeploy
    app, project, services, configs, version_id, deploy_options.promote)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/command_lib/app/output_helpers.py", line 111, in DisplayProposedDeployment
    DisplayProposedConfigDeployments(project, configs)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/command_lib/app/output_helpers.py", line 134, in DisplayProposedConfigDeployments
    project, 'cloudtasks.googleapis.com')
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/api_lib/services/enable_api.py", line 43, in IsServiceEnabled
    service = serviceusage.GetService(project_id, service_name)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/api_lib/services/serviceusage.py", line 168, in GetService
    exceptions.ReraiseError(e, exceptions.GetServicePermissionDeniedException)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/api_lib/services/exceptions.py", line 96, in ReraiseError
    core_exceptions.reraise(klass(api_lib_exceptions.HttpException(err)))
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/core/exceptions.py", line 146, in reraise
    six.reraise(type(exc_value), exc_value, tb)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/api_lib/services/serviceusage.py", line 165, in GetService
    return client.services.Get(request)
  File "/usr/lib/google-cloud-sdk/lib/googlecloudsdk/third_party/apis/serviceusage/v1/serviceusage_v1_client.py", line 297, in Get
    config, request, global_params=global_params)
  File "/usr/bin/../lib/google-cloud-sdk/lib/third_party/apitools/base/py/base_api.py", line 731, in _RunMethod
    return self.ProcessHttpResponse(method_config, http_response, request)
  File "/usr/bin/../lib/google-cloud-sdk/lib/third_party/apitools/base/py/base_api.py", line 737, in ProcessHttpResponse
    self.__ProcessHttpResponse(method_config, http_response, request))
  File "/usr/bin/../lib/google-cloud-sdk/lib/third_party/apitools/base/py/base_api.py", line 604, in __ProcessHttpResponse
    http_response, method_config=method_config, request=request)
GetServicePermissionDeniedException: PERMISSION_DENIED: The caller does not have permission
ERROR: (gcloud.app.deploy) PERMISSION_DENIED: The caller does not have permission

I've also tried the following roles:

I'm using the Project Editor role for now, which works but I would like to only permit the roles which are actually required.

Upvotes: 1

Views: 250

Answers (2)

Anonymous Banana
Anonymous Banana

Reputation: 1

Was banging my head against the wall for awhile with this myself, it seems "intuitively" you also need "serviceusage.services.list" perms, so Service Usage Viewer role

found via this issue https://issuetracker.google.com/issues/137078982

Upvotes: 0

guillaume blaquiere
guillaume blaquiere

Reputation: 76000

In addition of Cloud Tasks Queue Admin role, you have to add Service Account User to allow the service account of Cloud Task to generate token on behalf the service account.

Upvotes: 0

Related Questions