Google Cloud Storage 权限被拒绝

Question

I set up a Cloud Run which uses a Bucket on Cloud Storage . Locally I run it in a Docker Container , the credentials are passed using a json file, created and downloaded from IAM & Admin , and it works. When deployed, writing to the bucket throws an error:

{
    500 unable to sign bytes: googleapi: Error 403: Permission 'iam.serviceAccounts.signBlob' denied on resource (or it may not exist).
    Details:
    [{
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "domain": "iam.googleapis.com",
        "metadata": {
            "permission": "iam.serviceAccounts.signBlob"
        },
        "reason": "IAM_PERMISSION_DENIED"
    
    }]
    []
}
    

Any idea?

Answer 1

I had to add the Service Account Token Creator to the service account. I did it, but it did not work anyway because there is the need to deploy a new version of the service, so:

1. Add the role Service Account Token Creator
2. Deploy new version of the service