cloudtasks.CreateTask fails: `lacks IAM permission “cloudtasks.tasks.create”` even though my account has that permission

问题

I'm following the Creating HTTP Target tasks guide. When I run the code posted below I get this error:

cloudtasks.CreateTask: rpc error: code = PermissionDenied 
desc = The principal (user or service account)
lacks IAM permission "cloudtasks.tasks.create" for the resource
 "projects/my_project/locations/europe-west1/queues/my_queue" 
(or the resource may not exist).

I have signed in with gcloud auth login my@email.com. my@email.com has the following permissions set by my custom cloud task role:

• cloudtasks.locations.get
• cloudtasks.locations.list
• cloudtasks.queues.get
• cloudtasks.queues.list
• cloudtasks.tasks.create
• cloudtasks.tasks.delete
• cloudtasks.tasks.fullView
• cloudtasks.tasks.get
• cloudtasks.tasks.list
• cloudtasks.tasks.run

I don't get it. What more should I check?

main.go

// Run `PROJECT_ID=my_project QUEUE_ID=my_queue go run main.go`
package main

import (
  "context"
  "fmt"
  "os"

  cloudtasks "cloud.google.com/go/cloudtasks/apiv2"
  taskspb "google.golang.org/genproto/googleapis/cloud/tasks/v2"
)

var (
  locationID = "europe-west1"
  url        = "example.com/callback"
  message    = "testing"
)

func main() {
  projectID := os.Getenv("PROJECT_ID")
  queueID := os.Getenv("QUEUE_ID")

  task, err := createHTTPTask(projectID, locationID, queueID, url, message)
  if err != nil {
    fmt.Println(err)
  }
  fmt.Println(task)
}

// createHTTPTask creates a new task with a HTTP target then adds it to a Queue.
func createHTTPTask(projectID, locationID, queueID, url, message string) (*taskspb.Task, error) {
  // Create a new Cloud Tasks client instance.
  // See https://godoc.org/cloud.google.com/go/cloudtasks/apiv2
  ctx := context.Background()
  client, err := cloudtasks.NewClient(ctx)
  if err != nil {
    return nil, fmt.Errorf("NewClient: %v", err)
  }
  // Build the Task queue path.
  queuePath := fmt.Sprintf("projects/%s/locations/%s/queues/%s", projectID, locationID, queueID)
  // Build the Task payload.
  // https://godoc.org/google.golang.org/genproto/googleapis/cloud/tasks/v2#CreateTaskRequest
  req := &taskspb.CreateTaskRequest{
    Parent: queuePath,
    Task: &taskspb.Task{
      // https://godoc.org/google.golang.org/genproto/googleapis/cloud/tasks/v2#HttpRequest
      MessageType: &taskspb.Task_HttpRequest{
        HttpRequest: &taskspb.HttpRequest{
          HttpMethod: taskspb.HttpMethod_POST,
          Url:        url,
        },
      },
    },
  }
  // Add a payload message if one is present.
  req.Task.GetHttpRequest().Body = []byte(message)
  createdTask, err := client.CreateTask(ctx, req)
  if err != nil {
    return nil, fmt.Errorf("cloudtasks.CreateTask: %v", err)
  }
  return createdTask, nil
}

The Cloud Tasks API is enabled.

回答1:

I've been having the same issue for the past couple of days and figured it out. The library I was using to create the API client and create a task was using different credentials than I expected.

For those that are using "application default credentials", or at least letting the client find credentials automatically, take a look at this page: https://cloud.google.com/docs/authentication/production#finding_credentials_automatically

I had created a service account with all the right roles and was assuming the API client was using the service account. Turns out I wasn't passing in the key file and thus it was using the "application default credentials". For my use case, "application default credentials" referred to the App Engine default service account. When I supplied the API client with a key file for my custom service account, it worked.

回答2:

Application Default Credentials (ADC) provide a method to get credentials used in calling Google APIs. The gcloud auth application-default command group allows you to manage active credentials on your machine that are used for local application development.

Acquire new user credentials to use for ADC with the following command:

gcloud auth application-default login

来源：https://stackoverflow.com/questions/60394894/cloudtasks-createtask-fails-lacks-iam-permission-cloudtasks-tasks-create-ev