How to give Google Cloud Eventarc correct permission so it can trigger a cloud function?

Question

I have succesfully deployed a 2nd generation cloud function with a storage trigger per the google tutorial.

The Cloud Function works when I run a test command in the shell. But if I try for real by uploading a file to my bucket the could function is not invoked.

I can see that the event triggers the pubsub topic:

And in Eventarc I can see signs of the problem:

So, my layman analyse of why the cloud function invokation fails is that I lack some permission for Eventarc to receive the message from PubSub (?). I have read Eventarc troubleshooting and Eventarc accesscontrol and tried to add the eventarc admin role to the eventarc serviceaccount (as seen in image below) but to no result. (I've also added it to any other service account I can find, made the compute service account project owner, etc. but no luck). What am I missing?

(Note, I had an earlier question about this but with broader scope but I opted for a new, more specific question)

Conjunctiva

Have you given the needed permissions to the identity that triggers Eventarc and the Cloud function ? – Tightwad

The [email protected] has the 'Editor' role. I have tried with also giving it 'Owner' role and 'Eventarc Admin' role without any success. Maybe there is yet some other role that must be added but I fail to see which one. EDIT: Thanks, just saw your posted answer. Will try! – Conjunctiva

any progress to this issue? – Britton

Maybe giving roles/storage.admin to the <PROJECTNUM>[email protected] and then making the cloud function accessible without authentication would work. For me it did. I also made the cloud function for internal traffic only so accessing w/o authentication is not that big of risk. – Britton

Any news on this? We cannot deploy a function with the V2 Permission denied while using the Eventarc Service Agent. – Dibs

@Conjunctiva have you managed to solve the issue? – Printmaking

Has anyone managed to find a solution to this? Google's documentation is a crying shame. – Flatus

Answer 1

Check if your Pub/Sub service account has the iam.serviceAccountTokenCreator role. This could be the case if you enabled the Pub/Sub service account on or before April 8, 2021. (https://cloud.google.com/eventarc/docs/roles-permissions)

If you create a new eventarc trigger in the console you'll get a warning when the Pub/Sub service account doesn't have this role and you can enable it right there.

Wiggle

This was the problem for me that i was seeing the permission denied errors. So after granting grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the project to the Pub/Sub service agent it started working. – Jacquesjacquet

Answer 2

Stumble across the same issue, and found the solution at the "Permissions" tab of the cloud function I was trying to trigger.

Here is the solution that worked for me:

1. Find the service account that eventarc is using;
2. On IAM page give that principal the "Cloud Run Invoker" role;

Seems to be only necessary with the 2nd generation cloud functions.

Aeroneurosis

how do I find out the service account that eventarc is using? – Figueroa

Answer 3

You used the Compute Engine default Service Account.

You need to give the needed permissions to this Service Account :

According to the documentation :

Make sure the runtime service account key you are using for your Application Default Credentials has either the cloudfunctions.serviceAgent role or the storage.buckets.{get, update} and the resourcemanager.projects.get permissions. For more information on setting these permissions, see Granting, changing, and revoking access to resources.

Please check in IAM page if the default Service Account has the following permissions :

• cloudfunctions.serviceAgent
• storage.buckets.{get, update}
• resourcemanager.projects.get

Also, don't hesitate to check in Cloud logging to see the exact error and the missing permissions.

Tightwad

Unfortunately, adding those permissions didn't change anything. And, as far as I can see, Eventarc doesn't write anything to Cloud Logging. The only indication I get on the failure is in the Eventarc Trigger Details where the Invocations chart indicates permission_denied. – Conjunctiva

Answer 4

After working through the permissions issues I also had to allow the pubsub service account like so...

resource "google_project_iam_member" "pubsubtoken" {
  project = "example"
  role    = "roles/iam.serviceAccountTokenCreator"
  member  = "serviceAccount:service-####@gcp-sa-pubsub.iam.gserviceaccount.com"
}

Where ### is the gcp project number , so the trigger now works, when copying files to the bucket.

I plan to populate this from data shortly, like data.google_project.project.number

Delarosa

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center. – Halsy

Answer 5

I faced a similar case. I was trying to activate a Workflow with Eventarc whenever a new file was created in a Bucket.
I observed the same behavior on my Eventarc screen.
The solution was to assign the role roles/workflows.invoker to the Service Account (SA) used in the Eventarc (I used the same SA for both Eventarc and the Workflow).
You may need to assign the role roles/cloudfunctions.invoker to your SA.

If you notice, the graph you post in your question is the Invocations graph, so my proposal makes sense.

Rowell

Answer 6

I've spent a lot of time fixing the same issue. It helped to press "TRIGGER CLOUD FUNCTION" in Pub/Sub UI

Google Cloud UI suggested to give missing permissions to another service account. I've pressed "Grant All" and it helped to fix the issue.

The permission was missing not to my <project-id>-compute service account but to another.

Printmaking