Search code examples
google-cloud-platformgoogle-cloud-functionsgoogle-cloud-build

Permission 'run.services.setIamPolicy' denied on resource * (or resource may not exist)

Whenever I try to deploy a Google Cloud Platform (GCP) Cloud Function, I encounter this error. However, when I check the dashboard, the function has deployed correctly.

Preparing function...
.done.
Updating function (may take a while)...
[Build].....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................warning
[Service]........................................................................warning
Completed with warnings:
Warning: G] *** Improve build performance by generating and committing package-lock.json.
  [INFO] A new revision will be deployed serving with 100% traffic.
ERROR: (gcloud.functions.deploy) ResponseError: status=[403], code=[Ok], message=[Permission 'run.services.setIamPolicy' denied on resource 'projects/my-project-abcdef/locations/us-central1/services/my-function-name' (or resource may not exist).]
Error: Process completed with exit code 1.

enter image description here

My IAM service account has the following permissions:

  • Cloud Build Service Account
  • Cloud Functions Developer
  • Kubernetes Engine Admin
  • Kubernetes Engine Cluster Viewer
  • Service Account User
  • Storage Admin

And in the Cloud Build settings panel, the IAM service account has both the Cloud Functions and Service Accounts services enabled.

Solution

  • I found out adding Cloud Functions Admin role to the IAM service account fixed the issue. I'm not sure if that's the suggested way but it works.