gcloud: The user does not have access to service account “default”

Question

I attempting to use an activated service account scoped to create and delete gcloud container clusters (k8s clusters), using the following commands:

gcloud c         


        

Answer 1

After talking to Google Support, the issue was that the service account did not have a "Service Account User" permissions activated. Adding "Service Account User" resolves this error.

Answer 2

Add the following role to the service account who makes the operation:

Service Account User

Also see:

• https://cloud.google.com/kubernetes-engine/docs/how-to/iam#service_account_user

• https://cloud.google.com/iam/docs/service-accounts#the_service_account_user_role

• https://cloud.google.com/iam/docs/understanding-roles

Answer 3

For those that ended up here trying to do an Import of Firebase Firestore documents with a command such as:

gcloud beta firestore import --collection-ids='collectionA','collectionB' gs://YOUR_BUCKET

I got around the issue by doing the following:

1. From the Google Cloud Console Storage Bucket Browser, add the service account completing the operation to the list of members with a role of Storage Admin.
2. Re-attempt the operation.

For security, I revoked the role after the operation completed, but that's optional.