Your code is running on Cloud Functions in project A. It is supposed to write an object in a Cloud Storage bucket owned by project B. However, the write call is failing with the error "403…

Question

Options

• AGrant your user account the roles/storage.objectCreator role for the Cloud Storage bucket.
• BGrant your user account the roles/iam.serviceAccountUser role for the service-PROJECTA@gcf-
• CGrant the [email protected] service account the
• DEnable the Cloud Storage API in project B.

• A
  6% (2)
• B
  10% (3)
• C
  81% (25)
• D
  3% (1)

Explanation

Cloud Functions runs as a dedicated service account - typically [email protected]. When this function attempts to write an object to a Cloud Storage bucket in Project B, GCP evaluates the service account's permissions on that bucket. Because the bucket is in a different project, the service account has no default access. Granting it roles/storage.objectCreator on the target bucket in Project B resolves the 403. Granting your user account permissions (A, B) does not help because the code runs as the function's service account, not as you. Enabling the Storage API in Project B (D) is not the issue - the API is likely already enabled and a 403 indicates an authorization failure, not a disabled API.

No community discussion yet for this question.