如何部署 Google Cloud Function（第 2 代）？

Question

I've previously only used Cloud Functions of gen. 1 but now plan to move to 2nd generation and is just trying to deploy/test a first basic function. I'm just taking the Google sample for a storage triggered function and try to deploy it, but it keeps failing.
This is what it looks like:

> gcloud functions deploy nodejs-finalize-function --gen2 --runtime=nodejs16 --project myproject --region=europe-west3 --source=. --entry-point=handleImage --trigger-event-filters='type=google.cloud.storage.object.v1.finalized' --trigger-event-filters='bucket=se_my_images'

Preparing function...done.                                                                                                                                                            
X Deploying function...                                                                                                                                                               
  ✓ [Build] Logs are available at [https://console.cloud.google.com/cloud-build/builds;region=europe-west3/a8355043-adf0-4485-a510-1d54b7e11111?project=123445666123]                 
  ✓ [Service]                                                                                                                                                                         
  ✓ [Trigger]                                                                                                                                                                         
  - [ArtifactRegistry] Deleting function artifacts in Artifact Registry...                                                                                                            
  . [Healthcheck]                                                                                                                                                                     
  . [Triggercheck]                                                                                                                                                                    
Failed.                                                                                                                                                                               
ERROR: (gcloud.functions.deploy) OperationError: code=7, message=Creating trigger failed for projects/myproject/locations/europe-west3/triggers/nodejs-finalize-function-898863: The Cloud Storage service account for your bucket is unable to publish to Cloud Pub/Sub topics in the specified project.
To use GCS CloudEvent triggers, the GCS service account requires the Pub/Sub Publisher (roles/pubsub.publisher) IAM role in the specified project. (See https://cloud.google.com/eventarc/docs/run/quickstart-storage#before-you-begin)

The error looks easy to understand, but I have aded the Pub/Sub Publisher role to all my service accounts now (the ones listed below) and I still keep getting the same error.

>gcloud iam service-accounts list --project myproject
DISPLAY NAME                        EMAIL                                                   DISABLED
firebase-adminsdk                   firebase-adminsdk-u2x33@myproject.iam.gserviceaccount.com  False
Default compute service account     930445666575-compute@developer.gserviceaccount.com      False
backend-dev                         backend-dev@myproject.iam.gserviceaccount.com              False
App Engine default service account  myproject@appspot.gserviceaccount.com                      False

I don't know how to move forward from here so I hope someone can help.

*** EDIT ***.
I added the role to the listed service accounts in the GCP console, IAM > Permissions > View By Principal page/view where I used the Edit Principal button to assign an additional role (Pub/Sub Publisher) to the service accounts (note that I added the role to all my listed service accounts since I'm not 100% sure which one is used by GCP for cloud deployment).

Answer 1

since you are already using gcloud cli, i suggest you follow the step 2 which says:

PROJECT_ID=$(gcloud config get-value project)

PROJECT_NUMBER=$(gcloud projects list --filter="project_id:$PROJECT_ID" --format='value(project_number)')

SERVICE_ACCOUNT=$(gsutil kms serviceaccount -p $PROJECT_NUMBER)

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member serviceAccount:$SERVICE_ACCOUNT \
  --role roles/pubsub.publisher

After these 4 cmd's, you should have no problems.. I don't use gcp interface for iam purposes, since all my iam policies are uploaded by terraform/terragrunt.