Google cloud function permission problems

Question

I have two projects in GCP, let’s say project A and B. Project A is newly created, and project B is two years old. When I create a cloud function in project A, it’s created with the default services account (project@appspot…). However, when I create a cloud function on project B, a non existing service account is used. I know it doesn’t exist because it doesn’t appear on the IAM.

In the project A the cloud function created can access the datastore, however, the same cloud function in the project B isn’t able to access the datastore.

So, my questions are:

1. How can I know which google services account will be used by a cloud function?

2. Is there a way to change the used service account by project B to have a cloud function that access the datastore?

I have tried to give the appropriate permissions to the cloud function, but as long as is in project B it doesn’t work. What am I missing here?

Answer 1

It seems like there are two different accounts you need to check for in Project B.

First the Google APIs service account. You should make sure it exists and that it has the correct credentials to properly work with Cloud Functions. Below is the documentation from the GCP docs:

For administrative actions on your project during the creation, updating, or deletion of functions, the Cloud Functions service uses the Google APIs service account [email protected]. By default, this service account has the Editor role on your project. Creating, updating, and deleting functions may fail if you reduce this account's permissions.

Next is the runtime service account. From the issues you are describing this might be the real issue. Again, here is the documentation explaining it:

At runtime, Cloud Functions uses the service account [email protected], which has the Editor role on the project. You can change the roles of this service account to limit or extend the permissions for your running functions.