PIN: Enqueuing Cloud Tasks results in error - The principal (user or service account) lacks IAM permission iam.serviceAccounts.actAs

[thclark]

Pinned Note

NOTE: THIS IS NOT A BUG IN DJANGO-GCP

What is the current behavior?

On trying to enqueue a task from a django server running in Google Cloud Run, you may get the following error:

Traceback (most recent call last): File "/usr/local/lib/python3.9/site-packages/google/api_core/grpc_helpers.py", line 72, in error_remapped_callable return callable_(*args, **kwargs) 
File "/usr/local/lib/python3.9/site-packages/grpc/_channel.py", line 1030, in __call__ return _end_unary_response_blocking(state, call, False, None) 
File "/usr/local/lib/python3.9/site-packages/grpc/_channel.py", line 910, in _end_unary_response_blocking raise _InactiveRpcError(state) # pytype: disable=not-instantiable grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with: 
status = StatusCode.PERMISSION_DENIED 
details = "The principal (user or service account) lacks IAM permission "iam.serviceAccounts.actAs" for the resource "yourserviceaccount@yourproject.iam.gserviceaccount.com" (or the resource may not exist)." 

Until recently, django-gcp worked as expected. Some time around or somewhat before October 12th 2023, GCP changed something under the hood that broke the ability to place tasks in the queue. We started to get the above error on any attempt to enqueue() a task.

Fix

After a lot of diagnostics and a full measure of total disbelief, it turns out that now, in order to place a task on a queue, you have to allow the service account you're using to impersonate itself.

The solution to this in gcloud is to do:

gcloud iam service-accounts add-iam-policy-binding yourserviceaccount@yourproject.iam.gserviceaccount.com --member serviceAccount:yourserviceaccount@yourproject.iam.gserviceaccount.com --role roles/iam.serviceAccountUser

WARNING!

DO NOT TRY: An alternative solution of applying the roles/iam.serviceAccountUser to your entire project is floating around. This presents a grave security hole - a good discussion on that is given at the end of this thread.