Cloud Run Deployment Fails: "storage.buckets.get" Permission Denied with WIF

Google Cloud Compute Infrastructure
, ,
1

Hello Google Cloud Community,

I’m deploying to Cloud Run via GitHub Actions using (Preferred) Workload Identity Federation (no service account keys) and encountering a Storage bucket permission error despite seemingly correct IAM roles. Its a dart Application.

Error:

ERROR: (gcloud.run.deploy) 
Permission 'storage.buckets.get' denied on bucket [run-sources-kaisa-341a6-europe-west1].
Authenticated as principal from Workload Identity Federation pool.

Key Details:

  • Authentication Method: (Preffered) Workload Identity Federation (no static service account keys).
- uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: 'projects/818180271880/locations/global/workloadIdentityPools/github-new/providers/kaisa-backend'

  • Confirmed IAM Roles (assigned to the GitHub-linked identity):

    • roles/run.admin

    • roles/storage.objectAdmin

    • roles/iam.workloadIdentityUser

  • Bucket Exists: run-sources-kaisa-341a6-europe-west1 is accessible via other means.

Screenshots:

What could be the problem?

2

Hi @ianshaloom ,

Welcome to Google Cloud Community.

Access is denied due to insufficient permissions. The user lacks the storage.buckets.get permission, requiring either the roles/storage.bucketViewer or roles/storage.admin roles.

To Check Roles:

  1. Go to the IAM & Admin > IAM page in the Google Cloud Console.
  2. Make sure you are viewing the correct project (the name is at the top left of the page).
  3. Find your user principal (ex. your email address) in the list.
  4. Verify that the “Storage Admin” (roles/storage.admin) or **“**Storage Bucket Viewer” (roles/storage.bucketViewer) role is listed there, under that project.

If either of the roles is not listed you may grant the IAM roles.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.