将来自不同项目的服务帐户分配给 Pub/Sub 上的推送订阅

Question

The scenario is the following: I have two projects in the same organization and folder; let's call them project1 and project2 . I have a Pub/Sub topic on project2 and I have a Cloud Run service on project1 that I want to use as the endpoint for a push subscription for the topic. However, I don't want everyone to be able to access my Cloud Run service: I only want authorised service accounts to be able to invoke the service. Thus I created a service account on project1 that has the role/run.invoker role for the Cloud Run service. Now, when I go and create my subscription in the topic in project2 with the Cloud Run service as the endpoint and I try to associate to it the service account in project1 using the following command:

gcloud --project=project2 pubsub subscriptions create test_subscrption --topic=topic-name --topic-project=project2 --push-auth-service-account=service_account1 --push-endpoint=https://my-cloud-run-service.run.app/

I get the following:

ERROR: Failed to create subscription [projects/project2/subscriptions/test_subscrption]: User not authorized to perform this action.
ERROR: (gcloud.pubsub.subscriptions.create) Failed to create the following: [test_subscrption].

Note that the account with which I'm logged into GCP has the Owner permission at the organization level. Moreover, if I create a service account in project2 and use that instead of the service account on project1 , the subscription is created without problems. I'm aware that there are some permissions to set before associating a service account to a push subscription ( serviceAccountTokenCreator as described here and iam.serviceAccounts.actAs as described here ), but I can guarantee I did set those permission before trying to create my subscription, and I still got the same error. From all this I'm concluding that it is not possible to associate a service account from a different project to a push subscription in Pub/Sub (more to the point, if I try to create the subscription from the GCP UI in the dropdown menu for the service account to associate to the push subscription I only see the service accounts that are part of the same project as the topic and subscription). Can anybody confirm this, or tell me how to achieve my goal? My current solution has been to create a service account in project2 and associate that to the push subscription instead, but I would like to know if my original plan was even possible at all.

Answer 1

As mentioned in the comment, when you do it with the UI, you can only select the service account of the current project and it is impossible to use an external service account. Instead, you can create the push subscription in project1 and create the topic in project2.

Answer 2

I found the documentation that reinforces Pooja's answer:

This service account must be in the same project as the push subscription

Source: https://cloud.google.com/pubsub/docs/push#setting_up_for_push_authentication