PERMISSION_DENIED 403 error when triggering HTTP Cloud Function from Cloud Tasks

2
votes

I'm trying the Using Cloud Tasks to trigger Cloud Functions tutorial but when I try to run the created task I get an error:

Status code: 7 (PERMISSION_DENIED)
Reason for retrying: PERMISSION_DENIED(7): HTTP status code 403

I have created a new service account with the Cloud Functions Invoker role. And modified my code so the tasks are created using this service account:

const task = {
    httpRequest: {
      httpMethod: protos.google.cloud.tasks.v2.HttpMethod.POST,
      url,
      oidcToken: {
        serviceAccountEmail: '[email protected]',
      },

The task is created from a cloud function.

I have also modified the target Cloud Function access control so it can be accessed by allAuthenticatedUsers with the role Cloud Functions Invoker. I can test trigger the function using the cloud functions console without any error.

What did I miss? Any ideas?

2
google-cloud-functionsservice-accountsgoogle-cloud-tasks

2 Answers

3
votes

I just figured it out. I deployed the function with ingress-settings=internal-only. Thinking that Cloud Tasks would be considered an internal service. I had to change this to the default all, then it worked. internal-and-gclb also did not work.

1
votes

Go to the IAM page, locate the Cloud task service agent service account: service-<projectNumber>@gcp-sa-cloudtasks.iam.gserviceaccount.com and grant the role roles/iam.serviceAccountTokenCreator on it.

It's not mentioned in your tutorial. I guess you didn't do it.