GitLab对接GCP CD流水线报错：服务账号无存储桶访问权限

我们有一条对接GCP的GitLab CD流水线，已稳定运行一年，本周突然出现以下报错：

Failed to create cloud build: invalid bucket "staging.app-name.appspot.com"; default Cloud Build service account or user-specified service account does not have access to the bucket

Error: Error waiting to create StandardAppVersion: Error waiting for Creating StandardAppVersion: Error code 13, message: Failed to create cloud build: invalid bucket "staging.app-name.appspot.com"; default Cloud Build service account or user-specified service account does not have access to the bucket
│ com.google.net.rpc3.client.RpcClientException: <eye3 title='/ArgoAdminNoCloudAudit.CreateBuild, FAILED_PRECONDITION'/> APPLICATION_ERROR;google.devtools.cloudbuild.v1/ArgoAdminNoCloudAudit.CreateBuild;invalid bucket "staging.app-name.appspot.com"; default Cloud Build service account or user-specified service account does not have access to the bucket;AppErrorCode=9;StartTimeMs=1715936472431;unknown;ResFormat=uncompressed;ServerTimeSec=1.005573011;LogBytes=256;Non-FailFast;EndUserCredsRequested;EffSecLevel=none;ReqFormat=uncompressed;ReqID=b1b6321e03c03d53;GlobalID=0;Server=[2002:a05:66b4:4786:b0:4:a379:3cb]:4001.

当前流水线使用的认证服务账号为：

serviceAccount:gitlab-ci-service-account@our-organisation.iam.gserviceaccount.com

我们判断是IAM权限问题，已为目标Cloud Storage存储桶添加权限，执行gsutil iam get gs://staging.app-name.appspot.com的结果如下：

{
  "bindings": [
    {
      "members": [
        "projectEditor:company-name-internal-dev",
        "projectOwner:company-name-internal-dev"
      ],
      "role": "roles/storage.legacyBucketOwner"
    },
    {
      "members": [
        "projectViewer:company-name-internal-dev"
      ],
      "role": "roles/storage.legacyBucketReader"
    },
    {
      "members": [
        "serviceAccount:XXXXXXXXXXX@cloudbuild.gserviceaccount.com",
        "serviceAccount:gitlab-ci-service-account@project-name.iam.gserviceaccount.com"
      ],
      "role": "roles/storage.objectViewer"
    }
  ],
  "etag": "CAM="
}

此外，我们已按照指引启用了Compute Engine API，但问题仍未解决，寻求技术帮助。

内容的提问来源于stack exchange，提问作者Igor L.