"Gaia id not found" error on every gcloud command blocks IAM invoker binding on Gen2 Cloud Function

Google Cloud Serverless Applications
1

I’m trying to make a Gen2 Cloud Function (europe-west2, Node.js 20, HTTPS trigger) publicly invokable for a webhook, but every request — authenticated or not — returns a generic 401 “Unauthorized” from Google Frontend before it reaches my code.

Every single gcloud command I run in Cloud Shell, regardless of what it does, prints this line first:

Regional Access Boundary HTTP request failed after retries: response_data={‘error’: {‘code’: 404, ‘message’: ‘Not found; Gaia id not found for email [my-email]@[mydomain].com’, ‘status’: ‘NOT_FOUND’}}, retryable_error=False

What I’ve confirmed so far:

  • gcloud functions get-iam-policy and gcloud run services get-iam-policy both show allUsers correctly bound to roles/run.invoker and roles/cloudfunctions.invoker
  • Requests still fail identically on both the cloudfunctions.net URL and the underlying *.a.run.app URL
  • Even a manually generated identity token (gcloud auth print-identity-token --audiences=...) matching the function’s custom audience still gets rejected
  • Project-level org policy iam.allowedPolicyMemberDomains is already set to allowAll: true
  • No corresponding entries in Cloud Audit Logs (cloudaudit.googleapis.com/policy, protoPayload.status.code=7) for any of the rejected requests — nothing explaining the denial reason
  • This is a Google Workspace-backed GCP project (Business tier, no formal GCP support plan)

This looks like an identity/Gaia resolution issue at a layer above IAM, org policy, or audit logging, rather than a config problem I can fix myself. Has anyone seen “Gaia id not found” errors like this, and know what causes it or how to get it resolved without a paid support plan?

1 Like