My Cloud Functions 2nd gen (createPreference, mpWebhook, spendGemsForSkin) are rejected with the internal error: code: PA_UNAUTHORIZED_RESULT_FROM_POLICIES, blocked_by: PolicyAgent, status: 403. This happens even though the allUsers IAM binding with role roles/run.invoker is confirmed present (verified with gcloud run services get-iam-policy). I also tried recreating them from scratch (even rewriting the code using firebase-functions v1 syntax, they still get created as 2nd Gen). I checked active organization policies (18) and deny policies (none found) with no match. errorGroups id: CPTJ2fj3s5D8zwE. Traces: (PII Removed by Staff) What internal policy is blocking this and how can I lift it?
1 Like