google cloud functions - Setting correct permissions for gcloud storage firestore export

Question

Can someone point out what I'm missing here? I have a cloud function (triggered on a schedule) which executes this piece of code:

const client = new firestore.v1.FirestoreAdminClient()
const projectId = process.env.GCP_PROJECT || process.env.GCLOUD_PROJECT
const databaseName = client.databasePath(projectId, '(default)')
return client.exportDocuments({name: databaseName, outputUriPrefix: 'gs://BUCKET-NAME', collectionIds: [] })

and fails with this in the log:

Error: 7 PERMISSION_DENIED: Service account does not have access to Google Cloud Storage file: /XXX-XXX.
Error details: [email protected] does not have storage.buckets.get access to the Google Cloud Storage bucket.

This is how the permissions on that bucket are set (and to confirm, I set this and saved it about an hour ago—I just reopened the edit box to get the image):

So, as far as I can tell, [email protected] should have full access to that bucket. But it claims not to have. What am I missing?

question from:https://stackoverflow.com/questions/65844168/setting-correct-permissions-for-gcloud-storage-firestore-export

Answer 1

I guess it's a fairly complicated system, but it's very frustrating. The solution was to remove that permission, save it, then add it again. The internet equivalent of pressing the button harder I guess. Oh well. Posting anyway in case it helps anyone else.